In the Linux kernel, the following vulnerability has been resolved: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable().

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/11d128f7eacec276c75cf4712880a6307ca9c885 cve-icon cve-icon
https://git.kernel.org/stable/c/1c82f5a393d8b9a5c1ea032413719862098afd4b cve-icon cve-icon
https://git.kernel.org/stable/c/276822a00db3c1061382b41e72cafc09d6a0ec30 cve-icon cve-icon
https://git.kernel.org/stable/c/61a5c565fd2442d3128f3bab5f022658adc3a4e6 cve-icon cve-icon
https://git.kernel.org/stable/c/74c7d67a3c305fc1fa03c32a838e8446fb7aee14 cve-icon cve-icon
https://git.kernel.org/stable/c/87d947a0607be384bfe7bb0935884a711e35ca07 cve-icon cve-icon
https://git.kernel.org/stable/c/b447885ec9130cf86f355e011dc6b94d6ccfb5b7 cve-icon cve-icon
https://git.kernel.org/stable/c/b8ddf5107f53789448900f04fa220f34cd2f777e cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025050125-CVE-2025-23144-d85a@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-23144 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-23144 cve-icon
History

Thu, 29 May 2025 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-413
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

 cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Fri, 02 May 2025 14:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 02 May 2025 06:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 May 2025 13:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable().
Title backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-05-01T12:55:33.985Z

Updated: 2025-05-26T05:19:23.987Z

Reserved: 2025-01-11T14:28:41.512Z

Link: CVE-2025-23144

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-05-01T13:15:50.237

Modified: 2025-05-02T13:53:20.943

Link: CVE-2025-23144

cve-icon Redhat

Severity : Low

Publid Date: 2025-05-01T00:00:00Z

Links: CVE-2025-23144 - Bugzilla