Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-23091

18
FAUCET Score

CVE-2026-23091 describes a resource leak in the Linux kernel's intel_th driver, specifically affecting the handling of device references during output device open() and close() operations. This vulnerability, while not assigned a CVSS score, has a low FAUCET Risk Score of 17/100 and a very low EPSS score, suggesting minimal predicted exploitability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 4.4, < 5.10.249CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.11, < 5.15.199CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.16, < 6.1.162CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 6.2, < 6.6.122CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 6.7, < 6.12.68CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.12%
Probability of exploitation in next 30 days
EPSS Percentile
2.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0012 is in the 16th percentile among its peer group of 15,940 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (63)

ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-5.15 (focal)Fixed in: 5.15.0-1099.102~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (jammy)Fixed in: 5.15.0-1099.102
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (jammy)Fixed in: 5.15.0-1099.102
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1055.56~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-117.117.1~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1051.52~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-117.117
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (noble)Fixed in: 6.8.0-1055.58
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (noble)Fixed in: 6.8.0-1055.58+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (noble)Fixed in: 6.8.0-1058.61
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1058.61+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (noble)Fixed in: 6.8.0-1054.60
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (noble)Fixed in: 6.8.0-1041.44
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (noble)Fixed in: 6.8.0-1055.56
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (noble)Fixed in: 6.8.0-117.117.1
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (noble)Fixed in: 6.8.0-1056.60
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2045.46
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (noble)Fixed in: 6.8.1-1051.52
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx-zynqmp (jammy)Fixed in: 5.15.0-1070.74
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (noble)Fixed in: 6.8.0-1054.57
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1054.57.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1054.57~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (noble)Fixed in: 6.8.0-1024.24
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (noble)Fixed in: 6.8.0-1056.62
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-5.15 (focal)Fixed in: 5.15.0-1110.119~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (questing)Fixed in: 6.17.0-1014.14
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.17 (noble)Fixed in: 6.17.0-1013.13~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oem-6.17 (noble)Fixed in: 6.17.0-1020.20
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (questing)Fixed in: 6.17.0-1013.13
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-5.15 (focal)Fixed in: 5.15.0-1057.57~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx (noble)Fixed in: 6.8.0-1032.33
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-5.15 (focal)Fixed in: 5.15.0-1105.112~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-5.15 (focal)Fixed in: 5.15.0-175.185~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-176.186
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (jammy)Fixed in: 5.15.0-1105.112
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (jammy)Fixed in: 5.15.0-1105.114
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (jammy)Fixed in: 5.15.0-1101.107
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (jammy)Fixed in: 5.15.0-1088.96
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (jammy)Fixed in: 5.15.0-175.185
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (jammy)Fixed in: 5.15.0-1100.101
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (jammy)Fixed in: 5.15.0-1102.108
ubuntupatch availablevia ubuntu_usn
Product: linux (questing)Fixed in: 6.17.0-22.22
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (questing)Fixed in: 6.17.0-1010.11
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-5.15 (focal)Fixed in: 5.15.0-176.186~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (jammy)Fixed in: 5.15.0-1057.57
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-igx (jammy)Fixed in: 5.15.0-1046.46
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iot-realtime (jammy)Fixed in: 5.15.0-1097.99
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (jammy)Fixed in: 5.15.0-1104.113
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (jammy)Fixed in: 5.15.0-176.186+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (jammy)Fixed in: 5.15.0-1105.114+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.17 (noble)Fixed in: 6.17.0-1012.12~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (questing)Fixed in: 6.17.0-1012.12
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (jammy)Fixed in: 5.15.0-1110.119+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg-5.15 (focal)Fixed in: 5.15.0-1100.106~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-5.15 (focal)Fixed in: 5.15.0-1102.108~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (jammy)Fixed in: 5.15.0-1110.119
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg (jammy)Fixed in: 5.15.0-1100.106
ubuntupatch availablevia ubuntu_usn
Product: linux-kvm (jammy)Fixed in: 5.15.0-1097.102
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.17 (noble)Fixed in: 6.17.0-1012.12~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.17 (noble)Fixed in: 6.17.0-22.22~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.17 (noble)Fixed in: 6.17.0-1011.11~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (questing)Fixed in: 6.17.0-1012.12
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (questing)Fixed in: 6.17.0-1011.11

Vendor Advisories (24)

ubuntuUSN-8499-1

Linux kernel (Xilinx) vulnerabilities

Jul 2, 2026
ubuntuUSN-8278-2

Linux kernel (Azure) vulnerabilities

May 26, 2026
ubuntuUSN-8289-2

Linux kernel (NVIDIA) vulnerabilities

May 25, 2026
ubuntuUSN-8296-2

Linux kernel (NVIDIA Tegra) vulnerabilities

May 25, 2026
ubuntuUSN-8289-1

Linux kernel (NVIDIA) vulnerabilities

May 20, 2026
ubuntuUSN-8278-1

Linux kernel vulnerabilities

May 19, 2026
ubuntuUSN-8275-1

Linux kernel (Xilinx ZynqMP) vulnerabilities

May 19, 2026
ubuntuUSN-8180-6

Linux kernel (Raspberry Pi) vulnerabilities

May 11, 2026
ubuntuUSN-8257-1

Linux kernel (Raspberry Pi) vulnerabilities

May 7, 2026
ubuntuUSN-8245-1

Linux kernel vulnerabilities

May 7, 2026
ubuntuUSN-8243-1

Linux kernel (Azure) vulnerabilities

May 7, 2026
ubuntuUSN-8180-5

Linux kernel (IBM) vulnerabilities

Apr 24, 2026
ubuntuUSN-8180-4

Linux kernel (Azure FIPS) vulnerabilities

Apr 23, 2026
ubuntuUSN-8180-3

Linux kernel vulnerabilities

Apr 23, 2026
ubuntuUSN-8183-2

Linux kernel vulnerabilities

Apr 23, 2026
ubuntuUSN-8188-1

Linux kernel (HWE) vulnerabilities

Apr 17, 2026
ubuntuUSN-8187-1

Linux kernel (NVIDIA) vulnerabilities

Apr 17, 2026
ubuntuUSN-8186-1

Linux kernel (Real-time) vulnerabilities

Apr 17, 2026
ubuntuUSN-8180-2

Linux kernel (FIPS) vulnerabilities

Apr 17, 2026
ubuntuUSN-8183-1

Linux kernel (GCP) vulnerabilities

Apr 17, 2026
ubuntuUSN-8180-1

Linux kernel vulnerabilities

Apr 16, 2026
ubuntuUSN-8177-1

Linux kernel vulnerabilities

Apr 16, 2026
ubuntuUSN-8162-1

Linux kernel (NVIDIA Tegra) vulnerabilities

Apr 9, 2026
redhatCVE-2026-23091

kernel: intel_th: fix device leak on output open()

Feb 4, 2026

References

git.kernel.org / stable/c/0fca16c5591534cc1fec8b6181277ee3a3d0f26c
Patch
git.kernel.org / stable/c/64015cbf06e8bb75b81ae95b997e847b55280f7f
Patch
git.kernel.org / stable/c/95fc36a234da24bbc5f476f8104a5a15f99ed3e3
Patch
git.kernel.org / stable/c/af4b9467296b9a16ebc008147238070236982b6d
Patch
git.kernel.org / stable/c/b71e64ef7ff9443835d1333e3e80ab1e49e5209f
Patch
git.kernel.org / stable/c/bf7785434b5d05d940d936b78925080950bd54dd
Patch
git.kernel.org / stable/c/f9b059bda4276f2bb72cb98ec7875a747f042ea2
Patch