LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23101: leds: led-class: Only Add LED to leds_list when it is fully ready

In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized. This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work. This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in: ------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998 Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23101 is a Linux kernel race condition in LED registration. An LED could be added to a global list before its workqueue state was initialized, allowing a default trigger path to queue uninitialized work. The public record shows a kernel warning on Lenovo ThinkPad T14s hardware, but does not describe data theft, privilege escalation, or remote exploitation.

Executive priority

Treat this as a kernel maintenance item unless vendor advisories add higher impact. There is no sourced evidence of active exploitation, remote access, or business data exposure, but affected fleets should receive normal kernel update priority because kernel race fixes can affect system stability.

Technical view

In led-class, led_classdev_register() added an LED to leds_list before led_init_core() initialized led_classdev.set_brightness_work. led_trigger_register() for a default trigger could call led_trigger_set(), then led_set_brightness(), and attempt to queue that uninitialized work item. The fix moves list insertion until after led_init_core().

Likely exposure

Exposure appears limited to affected Linux kernel versions with LED class devices and default LED triggers. The reported reproducer involved the lenovo-thinkpad-t14s EC driver registering LEDs while snd_ctl_led loaded. The bundle does not prove broad hardware exposure or remote attackability.

Exploitation context

No KEV listing or cited source supports active exploitation. The described issue is a timing race during kernel driver/module initialization. The public description reports a kernel WARNING, not a weaponized exploit, privilege escalation path, or remotely triggerable attack.

Researcher notes

The source evidence is specific: list insertion occurred before work initialization, and a default trigger could reach led_set_brightness() during that window. Impact is not scored, CWE is not assigned, and exploitability is not established. Avoid overstating beyond the reported warning and stable kernel fix.

Mitigation direction

  • Update to a Linux kernel build containing the referenced stable fix commits.
  • Check distribution kernel advisories for the exact fixed package for your kernel stream.
  • Prioritize validation on Lenovo ThinkPad T14s or systems using similar LED trigger paths.
  • If patching is delayed, monitor vendor guidance for supported operational mitigations.

Validation and detection

  • Inventory Linux kernel versions against the affected version ranges in the CVE record.
  • Confirm whether deployed kernels include one of the referenced stable commits.
  • Review boot and kernel logs for LED trigger or workqueue warnings matching the trace.
  • Test patched kernels on representative hardware before broad workstation rollout.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23101 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcd, d23a22a74fded23a12434c9463fe66cec2b0afcdunaffected
LinuxLinux3.7, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.