In the Linux kernel’s qcom‑lpg LED driver, a mismatch occurs between the three‑bit register read via FIELD_GET and the five‑element array that is indexed without bounds checking. This flaw can cause the driver to read past the array, configuring the chip with arbitrary data and potentially corrupting system state or destabilizing the device.

All Linux kernel installations that include the unpatched qcom‑lpg LED driver are affected. The vulnerability applies to any kernel version containing the buggy source, regardless of vendor, and the advisory does not specify particular affected releases.

The CVSS score is not provided and EPSS data is unavailable, showing no public exploitation data. The flaw does not require special privileges beyond local execution. It is inferred that a local attacker could trigger the high‑resolution function with crafted input, leading to memory corruption, device instability, or denial of service. Because the kernel context is privileged, this could elevate the impact of a local attack. The vulnerability is not listed in CISA KEV, indicating no known widely used exploit.