CVE-2026-23101: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23101 is a use of uninitialized resource vulnerability (CWE-908) in the Linux kernel's LED class subsystem (leds/led-class). The flaw arises from a race condition where a LED device is added to the global leds_list before led_init_core() completes initialization of led_classdev.set_brightness_work. It affects Linux kernel versions from 3.7 up to (excluding) 5.10.249, 5.11–5.15.199, 5.16–6.1.162, 6.2–6.6.122, 6.7–6.12.68, and 6.13–6.18.8, as well as 6.19-rc1 through rc6. The vulnerability was published on February 4, 2026, with patches added on March 19, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly, kernel.org patches).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). When led_classdev_register() adds a new LED to leds_list prior to calling led_init_core(), a concurrent led_trigger_register() call for a default trigger can invoke led_trigger_set() → led_set_brightness(), which queues the not-yet-initialized led_classdev.set_brightness_work work item. This triggers a kernel WARNING in __flush_work() (kernel/workqueue.c:4234). The race is reproducible on hardware such as the Lenovo ThinkPad T14s, where the EC driver registers two LEDs with a default trigger from snd_ctl_led.ko in rapid succession — the async modprobe of snd_ctl_led can hit the window between list insertion and work queue initialization for the second LED. The attack vector is local, requires low privileges, and has high attack complexity due to the timing-dependent nature of the race (Feedly).

Successful triggering of this race condition results in a kernel WARNING and potential system instability or crash, impacting availability. There is no confidentiality or integrity impact — the vulnerability is limited to a denial-of-service scenario where the kernel work queue subsystem encounters an uninitialized work item, potentially causing a kernel panic or unexpected behavior on affected systems. The scope is limited to the local system; lateral movement or data exfiltration are not applicable (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Fixed versions include 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 6.18.8. The fix defers adding the LED device to leds_list until after led_init_core() completes, eliminating the initialization race window. Downstream distributions including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE (SUSE-2026-0962-1), Oracle Linux, and Amazon Linux 2 have issued updated kernel packages. Users should apply the latest kernel update for their distribution as soon as possible (kernel.org patches, Ubuntu USN-8180-1, Amazon Linux).