CVE-2026-93128

Overview

A bug in the Linux kernel’s LG laptop LED driver could cause the system to access or unregister a keyboard backlight LED that was never registered, potentially leading to a kernel crash or denial‑of‑service. The issue is fixed by tracking LED availability and using devres for cleanup.

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbd_backlight even when it was not successfully registered with the LED subsystem. The same happens inside acpi_remove(), where the LED devices are unregistered unconditionally. Fix this by tracking the availability of the kbd_backlight LED device and use devm_led_classdev_register() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device.

Impact

{'affected': 'Kernel and system stability', 'confidentiality': 'None', 'integrity': 'None', 'availability': 'High – potential kernel panic or service interruption'}

Remediation

['Apply the latest kernel update that includes the fix for CVE‑2026‑93128.', 'Verify that the kernel version on LG laptops is at least the patched release.', 'If using custom kernel builds, ensure the patch is applied and the LED device registration logic is unchanged.']

Risk context

Severity is high (CVSS 7.1) with no EPSS data, indicating a moderate to high urgency for patching to avoid possible kernel crashes.

Affected products

• Linux kernel
• LG laptop (x86 platform)
• Linux kernel LG laptop driver