What’s Vulnerable › Vulnerabilities

CVE-2026-93128: platform/x86: lg-laptop: Fix LED resource handling

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: lg-laptop: Fix LED resource handling The event notification callback might access kbd_backlight even when it was not successfully registered with the LED subsystem. The same happens inside acpi_remove(), where the LED devices are unregistered unconditionally. Fix this by tracking the availability of the kbd_backlight LED device and use devm_led_classdev_register() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device.

Affected products

• Linux: 5.15 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3e91964aa74ab261aa15d9d96318eded2fd9d22a
• https://git.kernel.org/stable/c/4f9f1448dac4927ce5160f3a4a295e08fb969d32
• https://git.kernel.org/stable/c/4fbfe3714f645b6c64c9ba8faa83b27e4c9f2edd
• https://git.kernel.org/stable/c/9a85e2d35e54248aca39bad4f4152ed34de1995f
• https://git.kernel.org/stable/c/acc190322250562d5f28860f4ae1ebaf3e304fc2
• https://git.kernel.org/stable/c/fc45f6e4b86c2fa1cf742c23a373d777d066aa25

Get alerted when CVE-2026-93128 or the next vulnerability affects your stack