The flaw occurs when the kernel adds an LED device to the global leds_list before the device's core initialization has finished. The LED is then referenced by its default trigger before the set_brightness_work structure is properly prepared. When snd_ctl_led is loaded asynchronously, it triggers the early work queueing with an uninitialized structure, causing a kernel warning. The weakness is a temporal race condition (CWE-908) that results in a denial of service.

The issue affects Linux kernel builds that have not yet incorporated the commit that moves LED addition to after led_init_core(). Known vulnerable releases include kernel 6.19 release candidates 6.19‑rc1 through 6.19‑rc6 on systems that load the snd_ctl_led module and use the default LED triggers. Any Linux installation prior to the fix is potentially affected, especially devices that register LEDs during startup, such as Lenovo ThinkPad T14s running those kernels.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be triggered during system boot when the snd_ctl_led module registers LEDs with default triggers before the LEDs are fully initialized. This requires the module to be loaded with kernel privileges during boot or on-demand. Successful exploitation would result in a kernel warning or potential crash, but the CVE description does not disclose any mechanism for privilege escalation or remote exploitation.