CVE-2026-46286 Details
Description
In the Linux kernel, the following vulnerability has been resolved: leds: qcom-lpg: Check for array overflow when selecting the high resolution When selecting the high resolution values from the array, FIELD_GET() is used to pull from a 3 bit register, yet the array being indexed has only 5 values in it. Odds are the hardware is sane, but just to be safe, properly check before just overflowing and reading random data and then setting up chip values based on that.
An array overflow vulnerability has been identified in the Linux kernel's QCOM LED driver. This issue arises when high-resolution values are selected from an array using the FIELD_GET() macro, which retrieves data from a 3-bit register. The problem occurs because the array being accessed contains only five values, creating a risk of reading random data. Although the hardware is likely functioning correctly, it is essential to implement proper checks to prevent overflow and ensure that only valid data is read before configuring chip values.
Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/28a2e047d03721e0517c67ee726eaa6621c30e5f | kernel.org | Patch |
| https://git.kernel.org/stable/c/36ce3094dc50598f38fd961b46688cd533940efc | kernel.org | Patch |
| https://git.kernel.org/stable/c/438e357b3cc6cd6900df271e4bc567bfe1142281 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d45963a93c1495e9f1338fde91d0ebba8fd22474 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f67a24e75d3251ba42538738120b6b659c0dca7d | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.4, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 8, 2026 | New CVE Received | kernel.org |