PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46286 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel, specifically in the leds: qcom-lpg module. The issue arises from an array overflow when selecting high resolution values. The FIELD_GET() function is used to pull from a 3-bit register, but the array being indexed only has 5 values. To prevent potential issues, proper checks have been added to ensure that the array index is within bounds.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Users of the Linux kernel, particularly those using the leds: qcom-lpg module, should be aware of this vulnerability and ensure that they are running the patched version of the kernel.

Technical summary

The vulnerability is caused by an array overflow in the leds: qcom-lpg module. The FIELD_GET() function is used to pull from a 3-bit register, but the array being indexed only has 5 values. This could potentially lead to random data being read and used to set up chip values.

Defensive priority

Medium

Recommended defensive actions

  • Update to the latest version of the Linux kernel
  • Ensure that the leds: qcom-lpg module is patched

Evidence notes

The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively. Additional information can be found in the source references [ref-4], [ref-5], [ref-6], [ref-7], and [ref-8].

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46286 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46286

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46286 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46286

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/28a2e047d03721e0517c67ee726eaa6621c30e5f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/36ce3094dc50598f38fd961b46688cd533940efc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/438e357b3cc6cd6900df271e4bc567bfe1142281

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d45963a93c1495e9f1338fde91d0ebba8fd22474

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f67a24e75d3251ba42538738120b6b659c0dca7d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.