CVE-2026-72241

Received Received - Intake

Buffer Overread in Linux Kernel LED Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr() on it might result in a buffer overread. The same thing will happen when said string is used by the LED class device. Fix this by using strnchr() instead and explicitly check that the name string is properly null-terminated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72241

EUVD

EUVD-2026-59140

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a potential buffer overread in the LED subsystem. The issue occurs because user-supplied name strings are not guaranteed to be null-terminated, which can cause functions like strchr() to read beyond the intended buffer. The fix replaces strchr() with strnchr() and adds checks to ensure proper null-termination.

Detection Guidance

This vulnerability is specific to the Linux kernel's LED subsystem and cannot be detected via network scanning. To check if your system is affected, verify the kernel version and inspect the uleds driver for the described issue. Use commands like 'uname -a' to check the kernel version and 'modinfo uleds' to inspect the module.

Impact Analysis

This vulnerability could allow an attacker with local access to cause a denial-of-service or potentially read sensitive kernel memory. It may lead to system instability or crashes if exploited.

Compliance Impact

This vulnerability involves a potential buffer overread in the Linux kernel's LED subsystem due to unchecked null-terminated strings. It does not directly impact data privacy or security controls typically addressed by GDPR or HIPAA. Compliance risks would only arise if exploitation led to system instability or unauthorized access, which is not indicated here.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not yet available, avoid using the uleds driver or restrict access to LED class devices to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-72241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70