---
id: CVE-2026-72241
title: 'leds: uleds: Fix potential buffer overread'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  leds: uleds: Fix potential buffer overread

  The name string supplied by userspace is not guaranteed to be
  null-terminated, so using strchr() on it might result in a buf…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    5bb89e23729f3a59592d699a437bb001f24b8f67
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    5ad6f6c9209e5777b896def9876708853ae26d0d
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    8bf529571cca60fb8af65d6d034bdbbc99a9127c
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    a91ac9fdac7385cbc98aeae55b4e5302125497a2
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    6dd51d84a9502553e58beade72823258871b8111
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    263ccdd627caeda6e980ed3c6e32bb4fd6b380b1
  - >-
    Linux >= e381322b0190c1253d347de3f28b5c37756fb651 <
    c19fe864f667afc49d1391d764e20b66555bcf7a
  - Linux 4.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:53:23.465115Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:23.693Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72241'
references:
  - url: 'https://git.kernel.org/stable/c/a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b'
  - url: 'https://git.kernel.org/stable/c/5bb89e23729f3a59592d699a437bb001f24b8f67'
  - url: 'https://git.kernel.org/stable/c/5ad6f6c9209e5777b896def9876708853ae26d0d'
  - url: 'https://git.kernel.org/stable/c/8bf529571cca60fb8af65d6d034bdbbc99a9127c'
  - url: 'https://git.kernel.org/stable/c/a91ac9fdac7385cbc98aeae55b4e5302125497a2'
  - url: 'https://git.kernel.org/stable/c/6dd51d84a9502553e58beade72823258871b8111'
  - url: 'https://git.kernel.org/stable/c/263ccdd627caeda6e980ed3c6e32bb4fd6b380b1'
  - url: 'https://git.kernel.org/stable/c/c19fe864f667afc49d1391d764e20b66555bcf7a'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12551
ingestedAt: '2026-11-06T18:00:12.586Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

leds: uleds: Fix potential buffer overread

The name string supplied by userspace is not guaranteed to be
null-terminated, so using strchr() on it might result in a buffer
overread. The same thing will happen when said string is used by
the LED class device.

Fix this by using strnchr() instead and explicitly check that
the name string is properly null-terminated.

## Affected

- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a84c59121dfdc7b324f72dc5012aa8fe5e7d2d7b`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5bb89e23729f3a59592d699a437bb001f24b8f67`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 5ad6f6c9209e5777b896def9876708853ae26d0d`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 8bf529571cca60fb8af65d6d034bdbbc99a9127c`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < a91ac9fdac7385cbc98aeae55b4e5302125497a2`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 6dd51d84a9502553e58beade72823258871b8111`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < 263ccdd627caeda6e980ed3c6e32bb4fd6b380b1`
- `Linux >= e381322b0190c1253d347de3f28b5c37756fb651 < c19fe864f667afc49d1391d764e20b66555bcf7a`
- `Linux 4.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.