Bug 2363279 (CVE-2025-23144) - CVE-2025-23144 kernel: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
Summary: CVE-2025-23144 kernel: backlight: led_bl: Hold led_access lock when calling l...
Keywords:
Status: NEW
Alias: CVE-2025-23144
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-01 14:01 UTC by OSIDB Bzimport
Modified: 2025-05-29 08:58 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-05-01 14:01:54 UTC 
In the Linux kernel, the following vulnerability has been resolved:

backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()

Lockdep detects the following issue on led-backlight removal:
  [  142.315935] ------------[ cut here ]------------
  [  142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80
  ...
  [  142.500725] Call trace:
  [  142.503176]  led_sysfs_enable+0x54/0x80 (P)
  [  142.507370]  led_bl_remove+0x80/0xa8 [led_bl]
  [  142.511742]  platform_remove+0x30/0x58
  [  142.515501]  device_remove+0x54/0x90
  ...

Indeed, led_sysfs_enable() has to be called with the led_access
lock held.

Hold the lock when calling led_sysfs_disable().
Comment 1 Avinash Hanwate 2025-05-02 06:20:18 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025050125-CVE-2025-23144-d85a@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.