Skip to content
Heist/ feed
Unrated

leds: led-class: Only Add LED to leds_list when it is fully ready

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized. This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work. This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in: ------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998 Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call.

Announced Source revision 1
Original source ↗

CVE-2026-23101

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23101

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "f7a6df659af777058833802c29b3b7974db5e78a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "d117fdcb21b05c0e0460261d017b92303cd9ba77",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "e90c861411fc84629a240384b0a72830539d3386",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "2757f7748ce2d0fa44112024907bafb37e104d6e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "da565bf98c9ad0eabcb09fc97859e0b52f98b7c3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "78822628165f3d817382f67f91129161159ca234",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d23a22a74fded23a12434c9463fe66cec2b0afcd",
        "lessThan": "d1883cefd31752f0504b94c3bcfa1f6d511d6e87",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/leds/led-class.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.7"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.7",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.249",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.199",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.162",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.122",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.68",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.8",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/leds/led-class.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23101

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#39752 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement