The Linux kernel’s LED subsystem can receive a user‑supplied name string that is not guaranteed to terminate with a null character. The kernel code applies the strchr() routine to locate a terminator, which may read beyond the end of the supplied buffer, leading to a memory bounds violation classified as CWE‑125. This overread can reveal kernel memory contents, presenting a risk of information disclosure.

All Linux kernel releases that implement the uleds LED class driver and have not yet integrated the patch are affected. The flaw exists in the default kernel images supplied by most Linux distributions until the fixed kernel code is incorporated.

Because the vulnerable code is exercised via a system call originating from user space, the attack is local and requires a user with rights to interact with the LED subsystem. It is inferred that an attacker could supply a crafted LED name to trigger the overread, exposing kernel data. The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, indicating limited public exploitation. The CVSS score of 5.5 reflects moderate risk, underscoring the need for timely mitigation.