LED Backlight Vulnerability in Linux Kernel Affects Multiple Devices

CVE-2025-68758

What is CVE-2025-68758?

The Linux kernel has identified a vulnerability related to the LED Backlight subsystem, where incorrect supplier-producer links are established. Specifically, when a class device functions as a supplier for LED devices, the devlink is improperly generated. This misconfiguration can lead to issues where the removal order of devices is not enforced, particularly in configurations involving device tree overlays. It results in a scenario where the LED driver is removed prior to the associated backlight device, causing a kernel NULL pointer dereference. The vulnerability has been addressed by ensuring correct devlink creation between consuming and supplying devices.

References