UnratedFix available
leds: uleds: Fix potential buffer overread
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr() on it might result in a buffer overread. The same thing will happen when said string is used by the LED class device. Fix this by using strnchr() instead and explicitly check that the name string is properly null-terminated.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.261, 5.15.212, 6.1.178, 6.12.97, 6.18.40, 6.6.145, 7.1.5
- CVEs
- CVE-2026-72241
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 04:55 UTC · Revision 1
Source evidence
leds: uleds: Fix potential buffer overread
core-osv · Original sourcePublished 15 Aug 2026, 05:54 UTC
In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr() on it might result in a buffer overread. The same thing will happen when said string is used by the LED class device. Fix this by using strnchr() instead and explicitly check that the name string is properly null-terminated.
osv:CVE-2026-72241
Kernel
Fixed versions: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5
Complete source record
{
"id": "4478a36f1fa5b9d0dbe67cc1b59aac99bf7de402a6612e99d8e433a607e034da",
"url": "https://osv.dev/vulnerability/CVE-2026-72241",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "leds: uleds: Fix potential buffer overread",
"summary": "In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr() on it might result in a buffer overread. The same thing will happen when said string is used by the LED class device. Fix this by using strnchr() instead and explicitly check that the name string is properly null-terminated.",
"evidence": "osv:CVE-2026-72241",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.261",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.212",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.178",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.145",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.97",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.40",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-72241",
"aliases": [
"CVE-2026-72241"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e381322b0190c1253d347de3f28b5c37756fb651"
},
{
"fixed": "a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b"
},
{
"fixed": "5bb89e23729f3a59592d699a437bb001f24b8f67"
},
{
"fixed": "5ad6f6c9209e5777b896def9876708853ae26d0d"
},
{
"fixed": "8bf529571cca60fb8af65d6d034bdbbc99a9127c"
},
{
"fixed": "a91ac9fdac7385cbc98aeae55b4e5302125497a2"
},
{
"fixed": "6dd51d84a9502553e58beade72823258871b8111"
},
{
"fixed": "263ccdd627caeda6e980ed3c6e32bb4fd6b380b1"
},
{
"fixed": "c19fe864f667afc49d1391d764e20b66555bcf7a"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72241.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "5.10.261"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.212"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.178"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.145"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.97"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.40"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72241.json"
}
}
],
"modified": "2026-10-28T02:30:25.896800782Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/263ccdd627caeda6e980ed3c6e32bb4fd6b380b1",
"https://git.kernel.org/stable/c/5ad6f6c9209e5777b896def9876708853ae26d0d",
"https://git.kernel.org/stable/c/5bb89e23729f3a59592d699a437bb001f24b8f67",
"https://git.kernel.org/stable/c/6dd51d84a9502553e58beade72823258871b8111",
"https://git.kernel.org/stable/c/8bf529571cca60fb8af65d6d034bdbbc99a9127c",
"https://git.kernel.org/stable/c/a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b",
"https://git.kernel.org/stable/c/a91ac9fdac7385cbc98aeae55b4e5302125497a2",
"https://git.kernel.org/stable/c/c19fe864f667afc49d1391d764e20b66555bcf7a",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72241.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-72241",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72241.json"
}
},
"related_cves": [
{
"value": "CVE-2026-72241",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 492595,
"published_at": "2026-08-15T05:54:29.64+00:00"
}