CVE-2026-68180

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix MSC output device reference leak

intel_th_output_open() looks up the output device with

bus_find_device_by_devt(), which returns the device with a reference that

must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()")

attempted to drop the reference from intel_th_output_release(). However,

a successful open replaces file->f_op with the output driver file

operations before returning, so close runs the output driver release

callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes

the per-file iterator and does not drop the device reference taken by

intel_th_output_open(). Consequently, every successful MSC output open

leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the

release path actually used for MSC output files. Remove the now-unused

intel_th_output_release() callback from intel_th_output_fops.