CVE-2026-23101

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

leds: led-class: Only Add LED to leds_list when it is fully ready

Before this change the LED was added to leds_list before led_init_core()

gets called adding it the list before led_classdev.set_brightness_work gets

initialized.

This leaves a window where led_trigger_register() of a LED's default

trigger will call led_trigger_set() which calls led_set_brightness()

which in turn will end up queueing the *uninitialized*

led_classdev.set_brightness_work.

This race gets hit by the lenovo-thinkpad-t14s EC driver which registers

2 LEDs with a default trigger provided by snd_ctl_led.ko in quick

succession. The first led_classdev_register() causes an async modprobe of

snd_ctl_led to run and that async modprobe manages to exactly hit

the window where the second LED is on the leds_list without led_init_core()

being called for it, resulting in:

------------[ cut here ]------------

WARNING: CPU: 11 PID: 5608 at kernel/workqu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References