CVE-2025-68758: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68758 is a NULL pointer dereference vulnerability in the Linux kernel's LED Backlight (led-bl) driver, caused by incorrect device link (devlink) creation between LED class devices and their backlight consumer. The flaw was published on January 5, 2026, and affects multiple stable Linux kernel versions. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Red Hat CVE, Feedly).

The root cause is a devlink misconfiguration in the led-bl driver: when the LED Backlight driver registers a supplier-consumer device link, it incorrectly targets the parent of the LED class device (e.g., the I2C bus adapter) rather than the LED device itself. This means the kernel's device removal ordering is not correctly enforced, allowing the LED supplier device to be unbound before the backlight consumer device. When this occurs, the backlight driver attempts to dereference a now-freed LED structure, triggering a NULL pointer dereference in led_put() and devm_led_release(). The vulnerability can be triggered via device tree overlay removal or by manually unbinding the LED class device (e.g., echo 11-0062 >/sys/bus/i2c/drivers/leds-pca963x/unbind) before the backlight consumer (NVD).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Affected systems include any Linux kernel deployment using the led-backlight driver with LED class device suppliers, particularly embedded or IoT systems using device tree overlays with LED driver chips such as the NXP PCA9632 (Red Hat CVE, Feedly).

1. Identify a vulnerable system: Locate a Linux system running a kernel version prior to the fix that uses the led-backlight driver with an LED class device supplier (e.g., NXP PCA9632 via I2C).
2. Gain local access: Obtain local access with sufficient privileges to interact with the sysfs device binding interface (typically root or equivalent).
3. Trigger incorrect removal order: Unbind the LED supplier device before the backlight consumer device using sysfs:

   echo 11-0062 > /sys/bus/i2c/drivers/leds-pca963x/unbind
   echo <backlight-device-name> > /sys/bus/platform/drivers/led-backlight/unbind

4. Alternatively, use device tree overlay removal: Remove a device tree overlay that includes both the LED driver chip and the backlight consumer, causing the kernel to attempt removal of the LED device before the backlight device.
5. Observe kernel crash: The kernel dereferences a NULL pointer in led_put() → devm_led_release(), resulting in a kernel panic and system crash (NVD).

• Logs: Kernel oops or panic messages containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 in /var/log/kern.log or dmesg output.
• Logs: Call trace entries referencing led_put+0xe0/0x140 and devm_led_release+0x6c/0x98 in kernel logs.
• Process/System: Unexpected system reboots or kernel panics on systems using LED backlight drivers with I2C-connected LED chips.
• File System/Sysfs: Evidence of manual unbind operations on LED or backlight devices via sysfs (e.g., shell history or audit logs showing writes to /sys/bus/i2c/drivers/leds-pca963x/unbind or /sys/bus/platform/drivers/led-backlight/unbind).

Apply the upstream kernel patches that add proper devlink creation between the led-backlight consumer and the supplying LED device. Patches have been committed to multiple stable kernel branches (see kernel.org stable commits: 08c9dc6b, 0e63ea43, 60a24070, 9341d669, 30cbe4b6, e06df738, 64739adf, cd01a24b). Distribution-specific updates are available from Red Hat, Debian (DSA-6127-1, DLA-4475-1), and Ubuntu (USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1). As a workaround, avoid manually unbinding LED class devices before their backlight consumer devices, and carefully manage device tree overlay removal ordering (Red Hat CVE, Debian LTS, Ubuntu USN-8179-1).

The vulnerability was addressed as part of Microsoft's January 2026 Patch Tuesday cycle for Azure Linux 3 kernel packages, and was noted in broader Patch Tuesday coverage (BleepingComputer). Red Hat, Debian, and Ubuntu all issued security advisories and updated kernel packages. No significant independent researcher commentary or social media discussion has been identified for this specific CVE.