{"id":"CVE-2026-72241","title":"leds: uleds: Fix potential buffer overread","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nleds: uleds: Fix potential buffer overread\n\nThe name string supplied by userspace is not guaranteed to be\nnull-terminated, so using strchr() on it might result in a buf…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5bb89e23729f3a59592d699a437bb001f24b8f67","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5ad6f6c9209e5777b896def9876708853ae26d0d","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 8bf529571cca60fb8af65d6d034bdbbc99a9127c","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a91ac9fdac7385cbc98aeae55b4e5302125497a2","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 6dd51d84a9502553e58beade72823258871b8111","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 263ccdd627caeda6e980ed3c6e32bb4fd6b380b1","Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < c19fe864f667afc49d1391d764e20b66555bcf7a","Linux 4.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:53:23.465115Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:23.693Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72241","references":[{"url":"https://git.kernel.org/stable/c/a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b"},{"url":"https://git.kernel.org/stable/c/5bb89e23729f3a59592d699a437bb001f24b8f67"},{"url":"https://git.kernel.org/stable/c/5ad6f6c9209e5777b896def9876708853ae26d0d"},{"url":"https://git.kernel.org/stable/c/8bf529571cca60fb8af65d6d034bdbbc99a9127c"},{"url":"https://git.kernel.org/stable/c/a91ac9fdac7385cbc98aeae55b4e5302125497a2"},{"url":"https://git.kernel.org/stable/c/6dd51d84a9502553e58beade72823258871b8111"},{"url":"https://git.kernel.org/stable/c/263ccdd627caeda6e980ed3c6e32bb4fd6b380b1"},{"url":"https://git.kernel.org/stable/c/c19fe864f667afc49d1391d764e20b66555bcf7a"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.12551,"ingestedAt":"2026-11-06T18:00:12.586Z","slug":"CVE-2026-72241","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nleds: uleds: Fix potential buffer overread\n\nThe name string supplied by userspace is not guaranteed to be\nnull-terminated, so using strchr() on it might result in a buffer\noverread. The same thing will happen when said string is used by\nthe LED class device.\n\nFix this by using strnchr() instead and explicitly check that\nthe name string is properly null-terminated.\n\n## Affected\n\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5bb89e23729f3a59592d699a437bb001f24b8f67`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5ad6f6c9209e5777b896def9876708853ae26d0d`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 8bf529571cca60fb8af65d6d034bdbbc99a9127c`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a91ac9fdac7385cbc98aeae55b4e5302125497a2`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 6dd51d84a9502553e58beade72823258871b8111`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 263ccdd627caeda6e980ed3c6e32bb4fd6b380b1`\n- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < c19fe864f667afc49d1391d764e20b66555bcf7a`\n- `Linux 4.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}