Executive brief
The Linux kernel's LP5860 RGB LED driver chip support contains a logic error that can cause a mutex to be unlocked twice during device initialization. This could potentially cause kernel crashes or hangs on systems using this LED driver, affecting availability of any application or service dependent on that hardware component.
Technical details
The vulnerability is a double-unlock condition in the lp5860_device_init() function within the LP5860 LED driver. When lp5860_init_dt() fails, the function attempts to unlock an already-released mutex in the error path. The root cause is improper lock/unlock ordering: the mutex is unlocked before checking the result of regmap_update_bits(), and then unlocked again in the error handling path when lp5860_init_dt() fails. This is a local kernel code path issue with no network attack vector. The fix reorganizes the mutex release to occur immediately after the critical section, ensuring the error path does not attempt a redundant unlock. No privilege escalation or remote exploitation is possible; the impact is limited to potential kernel deadlock or crash on affected systems with this LED driver loaded.
Affected products
- Linux Linux kernel versions containing the lp5860 driver (introduced in commit f0a66563aa2d)
Timeline
- 2026-09-17: disclosed
- 2026-07-02: patched: Patch committed to mainline by Lee Jones