CVE-2025-68758 backlight: led-bl: Add devlink to supplier LEDs
A local attacker with high privileges can trigger a kernel NULL pointer dereference by unbinding LED devices in a specific order, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68758?
CVE-2025-68758 is a vulnerability in Linux, published on 5 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
backlight: led-bl: Add devlink to supplier LEDs
LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device.
One consequence is that removal order is not correctly enforced.
Issues happen for example with the following sections in a device tree overlay:
// An LED driver chip pca9632@62 { compatible = "nxp,pca9632"; reg = <0x62>;
// ...
addon_led_pwm: led-pwm@3 { reg = <3>; label = "addon:led:pwm"; }; };
backlight-addon { compatible = "led-backlight"; leds = <&addon_led_pwm>; brightness-levels = <255>; default-brightness-level = <255>; };
In this example, the devlink should be created between the backlight-addon (consumer) and the pca9632@62 (supplier). Instead it is created between the backlight-addon (consumer) and the parent of the pca9632@62, which is typically the I2C bus adapter.
On removal of the above overlay, the LED driver can be removed before the backlight device, resulting in:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: led_put+0xe0/0x140 devm_led_release+0x6c/0x98
Another way to reproduce the bug without any device tree overlays is unbinding the LED class device (pca9632@62) before unbinding the consumer (backlight-addon):
echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind
Fix by adding a devlink between the consuming led-backlight device and the supplying LED device, as other drivers and subsystems do as well.
Which versions are affected by CVE-2025-68758?
How do I fix CVE-2025-68758?
Apply the vendor's patch.
Is CVE-2025-68758 being exploited?
There is no known exploitation of CVE-2025-68758 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68758, DEBIAN-CVE-2025-68758, GHSA-whh2-h34g-xx55, ROOT-OS-DEBIAN-11-CVE-2025-68758, ROOT-OS-DEBIAN-12-CVE-2025-68758, ROOT-OS-UBUNTU-2204-CVE-2025-68758 and 2 more.