CVE-2026-68180: Linux Kernel Privilege Escalation Flaw

CVE-2026-68180 Overview

CVE-2026-68180 is a resource management flaw in the Linux kernel's Intel Trace Hub (intel_th) driver. The issue affects the Memory Storage Controller (MSC) output path, where every successful open of an MSC output file leaks one device reference. The leak originates from intel_th_output_open(), which acquires a device reference through bus_find_device_by_devt() that is never released on the MSC close path. A prior fix in commit 95fc36a234da placed the drop in intel_th_output_release(), but a successful open swaps file->f_op to the output driver's file operations, so the MSC release callback runs instead.

Critical Impact
Repeated open operations on Intel Trace Hub MSC output devices cause a persistent device reference leak that can prevent proper driver teardown.

Affected Products

Linux kernel builds containing the intel_th driver with the MSC output subsystem
Kernel versions incorporating commit 95fc36a234da ("intel_th: fix device leak on output open()") prior to the fix
Systems using Intel Trace Hub hardware tracing on affected kernel trees

Discovery Timeline

2026-08-10 - CVE-2026-68180 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68180

Vulnerability Analysis

The vulnerability is a kernel memory/reference leak in the intel_th driver's MSC output handling. When userspace opens an MSC output file, intel_th_output_open() calls bus_find_device_by_devt() to locate the backing output device. That function returns the device with an elevated reference count that the caller must drop.

The earlier remediation attempted to balance this by dropping the reference from intel_th_output_release(), registered in intel_th_output_fops. However, a successful open() replaces file->f_op with the output driver's own file operations before returning. As a result, close() invokes the driver-specific release callback, not the generic one.

For MSC outputs, that callback is intel_th_msc_release(), which only frees the per-file iterator. It never calls put_device() on the reference acquired during open. Each open therefore accumulates one leaked reference on the output device.

Root Cause

The root cause is an asymmetry between the acquire and release paths introduced by file operation replacement. The reference is taken in the generic open handler but must be dropped in a driver-specific release handler that was not updated to match.

Attack Vector

A local user with permission to open the affected intel_th MSC character device can trigger the leak by repeatedly opening and closing the device. Each successful open increments the reference count on the underlying device object without a corresponding decrement, preventing clean driver unbind and unload sequences over time. No remote vector is exposed and no memory corruption is introduced by the flaw itself.

The fix moves the put_device() call into intel_th_msc_release(), matching the actual release path used for MSC output files, and removes the now-unused intel_th_output_release() callback from intel_th_output_fops.

Detection Methods for CVE-2026-68180

Indicators of Compromise

Failure to unbind or unload the intel_th_msc and intel_th modules after MSC output files have been opened
Growing refcount values on the sysfs device entry associated with the MSC output under /sys/bus/intel_th/devices/
rmmod returning EBUSY for intel_th_msc despite no visible open file descriptors

Detection Strategies

Audit installed kernel versions against the fixing commits 26e27b8, 761b785, c3a28f9, caba30e, and ddcf206 in the stable trees
Monitor lsmod reference counts for intel_th_msc on systems where Intel Trace Hub tracing is used
Correlate userspace access patterns on /dev/intel_th* MSC nodes with device teardown failures

Monitoring Recommendations

Enable kernel KMEMLEAK on test systems that exercise the intel_th MSC path to observe reference imbalance during driver teardown
Alert on repeated module unload failures for intel_th_msc in host telemetry
Track kernel package versions across the fleet to confirm patched builds are deployed on systems with Intel Trace Hub enabled

How to Mitigate CVE-2026-68180

Immediate Actions Required

Update the Linux kernel to a stable release containing the referenced fix commits for the intel_th driver
Restrict access to intel_th character devices to trusted debugging users through standard device node permissions
On systems that do not require hardware tracing, blacklist the intel_th_msc and intel_th modules

Patch Information

The fix is present in the upstream stable kernel commits 26e27b8, 761b785, c3a28f9, caba30e, and ddcf206. The patches drop the device reference inside intel_th_msc_release() and remove the unused intel_th_output_release() callback from intel_th_output_fops.

Workarounds

Avoid repeated open/close cycles on MSC output character devices until the patched kernel is deployed
Reboot affected systems to reset accumulated reference counts if driver teardown becomes blocked
Blacklist the intel_th_msc module on production hosts that do not use Intel Trace Hub tracing

bash

# Prevent loading of the affected module on hosts that do not need it
echo "blacklist intel_th_msc" | sudo tee /etc/modprobe.d/blacklist-intel_th_msc.conf
echo "blacklist intel_th" | sudo tee -a /etc/modprobe.d/blacklist-intel_th_msc.conf
sudo update-initramfs -u