CVE-2025-68758: Linux vulnerability

CVE-2025-68758: backlight: led-bl: Add devlink to supplier LEDs

In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device. One consequence is that removal order is not correctly enforced. Issues happen for example with the following sections in a device tree overlay: // An LED driver chip pca9632@62 { compatible = "nxp,pca9632"; reg = <0x62>; // ... addon_led_pwm: led-pwm@3 { reg = <3>; label = "addon:led:pwm"; }; }; backlight-addon { compatible = "led-backlight"; leds = <&addon_led_pwm>; brightness-levels = <255>; default-brightness-level = <255>; }; In this example, the devlink should be created between the backlight-addon (consumer) and the pca9632@62 (supplier). Instead it is created between the backlight-addon (consumer) and the parent of the pca9632@62, which is typically the I2C bus adapter. On removal of the above overlay, the LED driver can be removed before the backlight device, resulting in: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 ... Call trace: led_put+0xe0/0x140 devm_led_release+0x6c/0x98 Another way to reproduce the bug without any device tree overlays is unbinding the LED class device (pca9632@62) before unbinding the consumer (backlight-addon): echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind echo ...backlight-dock >/sys/bus/platform/drivers/led-backlight/unbind Fix by adding a devlink between the consuming led-backlight device and the supplying LED device, as other drivers and subsystems do as well.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 21:52 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash systems using LED-backed display backlight devices when related LED hardware is removed before its backlight consumer. The business impact is likely availability disruption on specific embedded or hardware-oriented Linux deployments, not broad remote compromise based on the supplied sources.

Executive priority

Treat this as targeted availability risk for affected Linux hardware platforms. It should be patched through normal kernel maintenance, with faster handling for embedded, kiosk, industrial, or appliance systems where display backlight disruption or kernel crashes affect operations.

Technical view

The led-backlight driver consumed LED class devices without a correct device link to the real LED supplier. Removal ordering could therefore be wrong, causing the LED driver to disappear before the backlight device and triggering a kernel NULL pointer dereference in LED cleanup paths.

Likely exposure

Exposure is most likely on Linux systems using the led-backlight driver with supplier LED class devices, including device-tree based embedded platforms. General servers without this hardware or driver path are less likely exposed. The supplied version data is incomplete and should be verified against vendor kernels.

Exploitation context

No active exploitation is supported by the bundle, and KEV is false. The described trigger involves device removal ordering, such as overlay removal or unbinding, and appears local or operational rather than remote. The sources do not establish privilege requirements or real-world exploitation.

Researcher notes

The root cause is incorrect supplier-consumer device linking for LED class suppliers. The fix adds a devlink between the led-backlight consumer and supplying LED device. The bundle does not provide CVSS, CWE, exploit maturity, or complete distribution-specific affected ranges.

Mitigation direction

Apply a Linux stable kernel update containing the referenced led-backlight devlink fix.
Check distribution or device-vendor advisories for backported fixes to maintained kernels.
Avoid unnecessary runtime removal of affected LED/backlight device overlays until patched.
Prioritize embedded or appliance fleets using LED-backed displays for assessment.

Validation and detection

Inventory systems using the led-backlight driver with LED class supplier devices.
Confirm deployed kernels include one of the referenced stable fix commits or vendor backport.
Review kernel logs for NULL pointer dereferences involving led_put or devm_led_release.
Validate vendor kernel package status against CVE-2025-68758 before closing exposure.

Prepared: Jul 11, 2026, 07:09 UTC (UTC+00:00)
Confidence: medium
Sources: 10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68758 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jan 5, 2026, 09:32 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Dec 24, 2025, 10:30 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Jan 5, 2026, 09:32 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 21:52 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/64739adf3eef063b8e2c72b7e919eac8c6480bf0CVE reference, Linux
https://git.kernel.org/stable/c/cd01a24b3e52d6777b49c917d841f125fe9eebd0CVE reference, Linux
https://git.kernel.org/stable/c/e06df738a9ad8417f1c4c7cd6992cda320e9e7caCVE reference, Linux
https://git.kernel.org/stable/c/30cbe4b642745a9488a0f0d78be43afe69d7555cCVE reference, Linux
https://git.kernel.org/stable/c/0e63ea4378489e09eb5e920c8a50c10caacf563aCVE reference, Linux
https://git.kernel.org/stable/c/60a24070392ec726ccfe6ad1ca7b0381c8d8f7c9CVE reference, Linux
https://git.kernel.org/stable/c/08c9dc6b0f2c68e5e7c374ac4499e321e435d46cCVE reference, Linux
https://git.kernel.org/stable/c/9341d6698f4cfdfc374fb6944158d111ebe16a9dCVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinuxae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33, ae232e45acf9621f2c96b41ca3af006ac7552c33unaffected

LinuxLinux5.6, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.63, 6.17.13, 6.18.2, 6.19affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.