CVE-2025-38378
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | 6.16 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's appletb-kbd driver, specifically in the appletb_kbd_probe function. When the driver probes for a touch bar keyboard, it allocates memory for a structure to manage keyboard data and sets up a timer. If the probe fails after the timer is armed, the allocated memory is freed but the timer remains active. When the timer expires, it tries to access the freed memory, causing a use-after-free error which can lead to system instability or crashes. The root cause is that the timer is not properly disarmed on failure paths.
How can this vulnerability impact me? :
This vulnerability can cause system instability or crashes due to the use-after-free error when the timer accesses freed memory. This could potentially be exploited to cause denial of service or other unpredictable behavior in the Linux kernel on affected systems using the appletb-kbd driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for use-after-free errors related to the appletb_kbd_probe function. Specifically, look for KASAN slab-use-after-free messages in the kernel log that mention __run_timers and appletb_kbd structures. You can check the kernel log using the command: dmesg | grep -i 'appletb_kbd' or dmesg | grep -i 'slab-use-after-free'. Additionally, enabling Kernel Address Sanitizer (KASAN) can help detect such use-after-free bugs during runtime.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, update the Linux kernel to a version where the fix is applied. The fix involves calling timer_delete_sync() to deactivate the timer on failure paths in appletb_kbd_probe, preventing the timer from accessing freed memory. If updating is not immediately possible, consider disabling the affected device or module (appletb-kbd) to prevent the vulnerable code from executing.