CVE-2026-23101

A race condition vulnerability was found in the Linux kernel's LED class subsystem. When registering LEDs, the device is added to leds_list before led_init_core() initializes the set_brightness_work workqueue. If a trigger registration occurs during this window, led_set_brightness() attempts to queue an uninitialized work structure, triggering a warning in __flush_work() and potentially causing undefined behavior.

This race was observed on Lenovo ThinkPad T14s systems where the EC driver registers two LEDs in quick succession with default triggers from snd_ctl_led module. The async module loading of snd_ctl_led can hit the exact window where the second LED is listed but not fully initialized. Impact is a kernel warning and potential workqueue corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.