CVE-2025-68758

A NULL pointer dereference vulnerability was found in the Linux kernel's LED backlight driver. The driver-device link (devlink) between the backlight consumer and LED supplier is incorrectly established with the parent device instead of the LED class device itself. This causes incorrect device removal ordering, where the LED driver can be unbound before the backlight driver, resulting in a NULL pointer dereference in led_put() during cleanup.

This vulnerability is triggered during device unbind operations, such as removing device tree overlays or manually unbinding drivers via sysfs. Exploitation requires local administrative access to unbind drivers in a specific order. The issue primarily affects embedded systems using LED-backlight configurations with device tree overlays.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.