CVE-2025-38378

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe

In probe appletb_kbd_probe() a "struct appletb_kbd *kbd" is allocated

via devm_kzalloc() to store touch bar keyboard related data.

Later on if backlight_device_get_by_name() finds a backlight device

with name "appletb_backlight" a timer (kbd->inactivity_timer) is setup

with appletb_inactivity_timer() and the timer is armed to run after

appletb_tb_dim_timeout (60) seconds.

A use-after-free is triggered when failure occurs after the timer is

armed. This ultimately means probe failure occurs and as a result the

"struct appletb_kbd *kbd" which is device managed memory is freed.

After 60 seconds the timer will have expired and __run_timers will

attempt to access the timer (kbd->inactivity_timer) however the kdb

structure has been freed causing a use-after free.

[ 71.636938] ==================================================================

[ 71.63791

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References