CVE-2025-23144

Q: What is the severity of CVE-2025-23144?

CVE-2025-23144 has a CVSS score of 5.5 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's LED backlight subsystem where the led_access lock is not properly held when calling led_sysfs_disable() during device removal. This can cause kernel warnings and potential system instability. It affects Linux systems using the led_bl driver for backlight control.

5.5 MEDIUM

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's LED backlight subsystem where the led_access lock is not properly held when calling led_sysfs_disable() during device removal. This can cause kernel warnings and potential system instability. It affects Linux systems using the led_bl driver for backlight control.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected kernel versions not specified in CVE, but patches exist in stable kernel trees

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using the led_bl driver for backlight control, typically on devices with LED-based displays.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to race condition leading to memory corruption or use-after-free scenarios.

🟠

Likely Case

Kernel warning messages in system logs and potential system instability during device removal operations.

🟢

If Mitigated

Minor performance impact during device removal with proper locking in place.

🌐 Internet-Facing: LOW - This is a local kernel driver issue requiring local access.

🏢 Internal Only: MEDIUM - Could affect system stability for users with appropriate local access privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and specific conditions to trigger the race condition during device removal.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits referenced in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/11d128f7eacec276c75cf4712880a6307ca9c885

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repositories. 2. Reboot the system to load the new kernel. 3. Verify the fix by checking kernel version.

🔧 Temporary Workarounds

Disable led_bl module

linux

Prevent loading of the vulnerable led_bl kernel module

echo 'blacklist led_bl' >> /etc/modprobe.d/blacklist.conf
rmmod led_bl

🧯 If You Can't Patch

Avoid hot-plugging or removing LED backlight devices
Monitor system logs for lockdep warnings related to led_bl

🔍 How to Verify

Check if Vulnerable:

Check if led_bl module is loaded: lsmod | grep led_bl

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions or test device removal while monitoring dmesg for warnings

📡 Detection & Monitoring

Log Indicators:

WARNING messages in dmesg about led_sysfs_enable
lockdep warnings mentioning led_bl or led_access

Network Indicators:

None - this is a local kernel issue

SIEM Query:

source="kernel" AND ("led_sysfs_enable" OR "led_bl" OR "lockdep") AND severity="WARNING"

📊 Metadata

CVE ID: CVE-2025-23144

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.04% exploit probability (11.5th percentile)

Published: May 1, 2025

Last Updated: November 6, 2025

🔗 References

https://git.kernel.org/stable/c/11d128f7eacec276c75cf4712880a6307ca9c885 Patch
https://git.kernel.org/stable/c/1c82f5a393d8b9a5c1ea032413719862098afd4b Patch
https://git.kernel.org/stable/c/276822a00db3c1061382b41e72cafc09d6a0ec30 Patch
https://git.kernel.org/stable/c/61a5c565fd2442d3128f3bab5f022658adc3a4e6 Patch
https://git.kernel.org/stable/c/74c7d67a3c305fc1fa03c32a838e8446fb7aee14 Patch
https://git.kernel.org/stable/c/87d947a0607be384bfe7bb0935884a711e35ca07 Patch
https://git.kernel.org/stable/c/b447885ec9130cf86f355e011dc6b94d6ccfb5b7 Patch
https://git.kernel.org/stable/c/b8ddf5107f53789448900f04fa220f34cd2f777e Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable led_bl module

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export