Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-68758

backlight: led-bl: Add devlink to supplier LEDs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device. One consequence is that removal order is not correctly enforced. Issues happen for example with the following sections in a device tree overlay: // An LED driver chip pca9632@62 { compatible = "nxp,pca9632"; reg = <0x62>; // ... addon_led_pwm: led-pwm@3 { reg = <3>; label = "addon:led:pwm"; }; }; backlight-addon { compatible = "led-backlight"; leds = <&addon_led_pwm>; brightness-levels = <255>; default-brightness-level = <255>; }; In this example, the devlink should be created between the backlight-addon (consumer) and the pca9632@62 (supplier). Instead it is created between the backlight-addon (consumer) and the parent of the pca9632@62, which is typically the I2C bus adapter. On removal of the above overlay, the LED driver can be removed before the backlight device, resulting in: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: led_put+0xe0/0x140 devm_led_release+0x6c/0x98 Another way to reproduce the bug without any device tree overlays is unbinding the LED class device (pca9632@62) before unbinding the consumer (backlight-addon): echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind Fix by adding a devlink between the consuming led-backlight device and the supplying LED device, as other drivers and subsystems do as well.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 64739adf3eef063b8e2c72b7e919eac8c6480bf0affected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < cd01a24b3e52d6777b49c917d841f125fe9eebd0affected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < e06df738a9ad8417f1c4c7cd6992cda320e9e7caaffected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 30cbe4b642745a9488a0f0d78be43afe69d7555caffected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 0e63ea4378489e09eb5e920c8a50c10caacf563aaffected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 60a24070392ec726ccfe6ad1ca7b0381c8d8f7c9affected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 08c9dc6b0f2c68e5e7c374ac4499e321e435d46caffected
  • ae232e45acf9621f2c96b41ca3af006ac7552c33 to < 9341d6698f4cfdfc374fb6944158d111ebe16a9daffected

Linux Linux

Default version status: affected

  • 5.6affected
  • 0 to < 5.6unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.63 to ≤ 6.12.*unaffected
  • 6.17.13 to ≤ 6.17.*unaffected
  • 6.18.2 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References