CVE-2026-93128 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: lg-laptop: Fix LED resource handling
The event notification callback might access kbd_backlight even when it was not successfully registered with the LED subsystem. The same happens inside acpi_remove(), where the LED devices are unregistered unconditionally.
Fix this by tracking the availability of the kbd_backlight LED device and use devm_led_classdev_register() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel within the lg-laptop driver module represents a resource management flaw that can lead to use-after-free conditions or null pointer dereferences during system operations involving keyboard backlight controls. This specific issue arises from improper handling of LED class devices, particularly regarding their lifecycle and registration state relative to ACPI event notifications and device removal procedures. The core technical deficiency lies in the lack of conditional checks before accessing the kbd_backlight structure within the event notification callback function. When an ACPI event triggers a response related to keyboard backlight adjustments, the driver attempts to interact with this LED object without verifying whether it was successfully registered with the Linux LED subsystem during initialization. If registration fails due to hardware incompatibility, missing firmware interfaces, or other transient errors, the pointer remains invalid or uninitialized, leading to potential kernel crashes when accessed.
Furthermore, the vulnerability extends into the device removal phase managed by acpi_remove(). In this context, the driver unregisters LED devices unconditionally without checking if they were ever successfully created or registered. This unconditional cleanup attempts to free resources that may not exist in the expected state, creating a race condition or invalid memory access scenario. Such behavior violates fundamental principles of safe resource management where every allocation must have a corresponding conditional deallocation based on successful initialization. The lack of tracking for LED device availability means the driver operates under an assumption of success that is not guaranteed by the underlying hardware or firmware implementation, exposing the system to instability during hot-plug events, suspend-resume cycles, or module unloading operations.
From a security and stability perspective, this flaw aligns with CWE-416, Use After Free, as accessing uninitialized or freed memory structures can lead to arbitrary code execution if an attacker can influence ACPI event generation timing relative to device registration states. It also relates to CWE-754: Improper Check for Unusual or Exceptional Conditions, since the driver fails to validate the success of critical initialization steps before proceeding with dependent operations. In terms of MITRE ATT&CK mapping, this vulnerability could potentially be leveraged in techniques associated with T1059 Command and Scripting Interpreter if an attacker can trigger specific ACPI events that cause kernel panic or memory corruption, although more commonly it results in denial of service through system instability rather than direct privilege escalation. The impact is primarily localized to the local machine's stability but could affect availability for users relying on laptop functionality with LG hardware variants supported by this driver.
The resolution involves implementing robust state tracking mechanisms within the lg-laptop driver codebase. By introducing a flag or variable to explicitly track the availability status of the kbd_backlight LED device, subsequent access points such as event callbacks can perform conditional checks before dereferencing pointers. This ensures that operations are only performed when the resource is confirmed to be valid and registered. Additionally, the fix utilizes devm_led_classdev_register(), a managed resource API provided by the Linux kernel's driver model framework. Managed resources automatically handle cleanup upon device detachment or error paths, eliminating the need for manual unregister calls in acpi_remove() that were previously unconditional. Changing the parent device of LED devices to the native platform device ensures proper hierarchy and lifecycle management within the devres subsystem, guaranteeing that resource deallocation occurs safely only after successful registration and before driver removal completes.
To mitigate similar vulnerabilities in other kernel drivers or maintain existing systems, developers should adopt managed resource APIs wherever possible to reduce manual memory management errors. Implementing strict state validation checks before accessing hardware-specific structures is essential for preventing use-after-free scenarios. Regular code audits focusing on ACPI event handlers and device remove functions can identify patterns where conditional logic was omitted during error path handling. For system administrators running affected kernels, applying the latest kernel updates that include this patch is critical to maintaining system stability. Monitoring dmesg logs for LED subsystem errors may help detect early signs of improper resource handling before they escalate into full kernel panics or security incidents involving memory corruption exploits targeting these specific driver components.