Medium [CVE-2026-68180] Linux kernel: intel_th driver memory leak leading to Denial of Service

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release().

However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open().

Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files.

Remove the now-unused intel_th_output_release() callback from intel_th_output_fops. A flaw was found in the `intel_th` (Intel Trace Hub) driver within the Linux kernel.

This vulnerability occurs because the `intel_th_output_open()` function acquires a device reference that is not properly released by the `intel_th_msc_release()` function when handling Message Signaled Interrupt (MSC) outputs.