CVE-2026-72241

A flaw was found in the kernel. In the leds: uleds module, a buffer overread can occur because the name string provided by userspace is not guaranteed to be null-terminated. This can lead to a local attacker potentially reading sensitive information from adjacent memory or causing a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access to write to the userspace LED device node, restricting the blast radius to a local denial of service or bounded memory read rather than arbitrary code execution. In Red Hat Enterprise Linux, the uleds driver is not enabled in default kernel configurations, mitigating exposure on standard installations. Only custom environments where this specialized driver is explicitly enabled and loaded are susceptible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.