Cloudanix VulnDB

CVE-2026-93128

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug on certain LG laptops could let the operating system try to use hardware controls that were never properly set up, potentially causing crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The lg-laptop driver can invoke callbacks or removal paths that dereference a kbd_backlight LED device that was never successfully registered, creating a use-after-free or invalid pointer access in the Linux kernel LED subsystem.

Why it matters to the business

On affected LG laptop hardware, kernel crashes or unpredictable behavior may occur during ACPI events or module unload, leading to system instability and potential data loss or downtime.

How an attack unfolds

An attacker with local access triggers ACPI notifications or module removal sequences that exercise the event callback or acpi_remove path, causing the kernel to access an unregistered LED device and resulting in memory corruption.

How to fix it

Update to a Linux kernel containing the referenced fix that tracks LED registration state and switches to devm_led_classdev_register for automatic cleanup; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the kernel source contains the commit that adds registration tracking and uses devm_led_classdev_register; verify the lg-laptop module loads and unloads cleanly without oops on affected hardware.

Typical attack path

  1. Obtain local code execution on an affected LG laptop running a vulnerable kernel
  2. Trigger ACPI or platform events that invoke the lg-laptop LED notification callback
  3. Force or wait for module unload / ACPI removal to execute unconditional unregister paths
  4. Cause the kernel to dereference the unregistered kbd_backlight pointer leading to UAF

How to detect it

Review kernel logs for oops or panic messages referencing lg-laptop, kbd_backlight, or LED classdev during ACPI or module removal events; no public exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates for all LG laptop fleets within standard patch windows given low EPSS and no known exploitation
  • Monitor vendor kernel releases for the lg-laptop LED handling fix and schedule staged rollouts
  • Test module load/unload and ACPI event handling on representative hardware before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbd_backlight even when it was not successfully registered with the LED subsystem. The same happens inside acpi_remove(), where the LED devices are unregistered unconditionally. Fix this by tracking the availability of the kbd_backlight LED device and use devm_led_classdev_register() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device.

Affected packages

Ecosystem Package Introduced Fixed