CVE-2026-93128: platform/x86: lg-laptop: Fix LED resource handling
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: lg-laptop: Fix LED resource handling
The event notification callback might access kbdbacklight even when it was not successfully registered with the LED subsystem. The same happens inside acpiremove(), where the LED devices are unregistered unconditionally.
Fix this by tracking the availability of the kbdbacklight LED device and use devmledclassdevregister() to let devres take care of unregistering the LED devices during removal. For this the parent device of the LED devices is changed to the native platform device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In platform/x86 lg-laptop, track whether the kbd_backlight LED device was successfully registered before accessing or unregistering it; use devm_led_classdev_register() so devres handles LED unregistration during removal, and set the LED devices' parent to the native platform device.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel lg-laptop platform driver are exposed when the driver handles event notifications or device removal and the keyboard-backlight LED device was not successfully registered.
What condition triggers the unsafe access?
The issue occurs if kbd_backlight LED registration fails or is otherwise unavailable, but the event notification callback still accesses it. Device removal can also trigger the problem because LED devices were previously unregistered unconditionally.
How can I tell whether a system may be affected?
Check whether the running kernel includes the lg-laptop driver and whether keyboard-backlight LED registration can fail during driver initialization. Systems experiencing the affected path may encounter failures during lg-laptop event handling or device removal.
What is the mitigation if an updated kernel cannot be deployed immediately?
The provided information does not specify a configuration workaround. Reducing exposure would require avoiding use of the affected lg-laptop driver or the conditions that cause keyboard-backlight LED registration to fail, where operationally feasible.