CVE-2026-23091Missing Release of Memory after Effective Lifetime in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
Latest updateApr 16

Description

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

NVDlinux/linux_kernel4.45.10.249+6
Debianlinux/linux_kernel< 5.10.249-1+3
CVEListV5linux/linux39f4034693b7c7bd1fe4cb58c93259d600f55561af4b9467296b9a16ebc008147238070236982b6d+7

Patches

🔴Vulnerability Details

3
CVEList
intel_th: fix device leak on output open()2026-02-04
OSV
CVE-2026-23091: In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken w2026-02-04
GHSA
GHSA-phfq-ppcx-5j3h: In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken2026-02-04

📋Vendor Advisories

5
Ubuntu
Linux kernel vulnerabilities2026-04-16
Ubuntu
Linux kernel vulnerabilities2026-04-16
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities2026-04-09
Red Hat
kernel: intel_th: fix device leak on output open()2026-02-04
Debian
CVE-2026-23091: linux - In the Linux kernel, the following vulnerability has been resolved: intel_th: f...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-23091 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-23091 — Linux vulnerability | cvebase