In the Linux kernel, the following vulnerability has been resolved:

leds: uleds: Fix potential buffer overread

The name string supplied by userspace is not guaranteed to be
null-terminated, so using strchr() on it might result in a buffer
overread. The same thing will happen when said string is used by
the LED class device.

Fix this by using strnchr() instead and explicitly check that
the name string is properly null-terminated.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
e381322b0190c1253d347de3f28b5c37756fb651 affected < a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b
e381322b0190c1253d347de3f28b5c37756fb651 affected < 5bb89e23729f3a59592d699a437bb001f24b8f67
e381322b0190c1253d347de3f28b5c37756fb651 affected < 5ad6f6c9209e5777b896def9876708853ae26d0d
e381322b0190c1253d347de3f28b5c37756fb651 affected < 8bf529571cca60fb8af65d6d034bdbbc99a9127c
e381322b0190c1253d347de3f28b5c37756fb651 affected < a91ac9fdac7385cbc98aeae55b4e5302125497a2
e381322b0190c1253d347de3f28b5c37756fb651 affected < 6dd51d84a9502553e58beade72823258871b8111
e381322b0190c1253d347de3f28b5c37756fb651 affected < 263ccdd627caeda6e980ed3c6e32bb4fd6b380b1
e381322b0190c1253d347de3f28b5c37756fb651 affected < c19fe864f667afc49d1391d764e20b66555bcf7a
Linux Linux affected
Version Status Constraints
4.10 affected —
0 unaffected < 4.10
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/263ccdd627caeda6e980ed3c6e32bb4fd6b380b1 cve-icon cve-icon
https://git.kernel.org/stable/c/5ad6f6c9209e5777b896def9876708853ae26d0d cve-icon cve-icon
https://git.kernel.org/stable/c/5bb89e23729f3a59592d699a437bb001f24b8f67 cve-icon cve-icon
https://git.kernel.org/stable/c/6dd51d84a9502553e58beade72823258871b8111 cve-icon cve-icon
https://git.kernel.org/stable/c/8bf529571cca60fb8af65d6d034bdbbc99a9127c cve-icon cve-icon
https://git.kernel.org/stable/c/a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b cve-icon cve-icon
https://git.kernel.org/stable/c/a91ac9fdac7385cbc98aeae55b4e5302125497a2 cve-icon cve-icon
https://git.kernel.org/stable/c/c19fe864f667afc49d1391d764e20b66555bcf7a cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied by userspace is not guaranteed to be null-terminated, so using strchr() on it might result in a buffer overread. The same thing will happen when said string is used by the LED class device. Fix this by using strnchr() instead and explicitly check that the name string is properly null-terminated.
Title leds: uleds: Fix potential buffer overread
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:54:29.640Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72241

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:51.183

Modified: 2026-08-15T06:21:51.183

Link: CVE-2026-72241

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.