Skip to content
Heist/ feed
Back to feed
UnratedFix available

intel_th: fix device leak on output open()

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.249, 5.15.199, 6.1.162, 6.12.68, 6.18.8, 6.6.122
CVEs
CVE-2026-23091
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 23:08 UTC · Revision 1

Source evidence

intel_th: fix device leak on output open()

core-osv · Original source

Published 4 Feb 2026, 16:08 UTC

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().

osv:CVE-2026-23091

Kernel

Fixed versions: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8

Complete source record
{
  "id": "843148bb6068fc39c23a4048c9168a0ba313355b0aa6f521f7dcaef90ffb7bd0",
  "url": "https://osv.dev/vulnerability/CVE-2026-23091",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "intel_th: fix device leak on output open()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().",
    "evidence": "osv:CVE-2026-23091",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.249",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.199",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.162",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.122",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.68",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-23091",
      "aliases": [
        "CVE-2026-23091"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "39f4034693b7c7bd1fe4cb58c93259d600f55561"
                },
                {
                  "fixed": "af4b9467296b9a16ebc008147238070236982b6d"
                },
                {
                  "fixed": "64015cbf06e8bb75b81ae95b997e847b55280f7f"
                },
                {
                  "fixed": "b71e64ef7ff9443835d1333e3e80ab1e49e5209f"
                },
                {
                  "fixed": "bf7785434b5d05d940d936b78925080950bd54dd"
                },
                {
                  "fixed": "0fca16c5591534cc1fec8b6181277ee3a3d0f26c"
                },
                {
                  "fixed": "f9b059bda4276f2bb72cb98ec7875a747f042ea2"
                },
                {
                  "fixed": "95fc36a234da24bbc5f476f8104a5a15f99ed3e3"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23091.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.4.0"
                },
                {
                  "fixed": "5.10.249"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.199"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.162"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.122"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.68"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23091.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.202565895Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0fca16c5591534cc1fec8b6181277ee3a3d0f26c",
        "https://git.kernel.org/stable/c/64015cbf06e8bb75b81ae95b997e847b55280f7f",
        "https://git.kernel.org/stable/c/95fc36a234da24bbc5f476f8104a5a15f99ed3e3",
        "https://git.kernel.org/stable/c/af4b9467296b9a16ebc008147238070236982b6d",
        "https://git.kernel.org/stable/c/b71e64ef7ff9443835d1333e3e80ab1e49e5209f",
        "https://git.kernel.org/stable/c/bf7785434b5d05d940d936b78925080950bd54dd",
        "https://git.kernel.org/stable/c/f9b059bda4276f2bb72cb98ec7875a747f042ea2",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23091.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-23091",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23091.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-23091",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 490755,
  "published_at": "2026-02-04T16:08:14.295+00:00"
}