CVE-2025-38378

In the Linux kernel, the following vulnerability has been resolved:

HID: appletb-kbd: fix slab use-after-free bug in appletbkbdprobe

In probe appletbkbdprobe() a "struct appletbkbd *kbd" is allocated via devmkzalloc() to store touch bar keyboard related data. Later on if backlightdevicegetbyname() finds a backlight device with name "appletbbacklight" a timer (kbd->inactivitytimer) is setup with appletbinactivitytimer() and the timer is armed to run after appletbtbdim_timeout (60) seconds.

A use-after-free is triggered when failure occurs after the timer is armed. This ultimately means probe failure occurs and as a result the "struct appletb_kbd *kbd" which is device managed memory is freed. After 60 seconds the timer will have expired and __runtimers will attempt to access the timer (kbd->inactivitytimer) however the kdb structure has been freed causing a use-after free.

[ 71.636938] ================================================================== [ 71.637915] BUG: KASAN: slab-use-after-free in __runtimers+0x7ad/0x890 [ 71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0 [ 71.637915] [ 71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary) [ 71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 71.637915] Call Trace: [ 71.637915] <IRQ> [ 71.637915] dumpstacklvl+0x53/0x70 [ 71.637915] printreport+0xce/0x670 [ 71.637915] ? __runtimers+0x7ad/0x890 [ 71.637915] kasanreport+0xce/0x100 [ 71.637915] ? __run_timers+0x7ad/0x890 [ 71.637915] __runtimers+0x7ad/0x890 [ 71.637915] ? pfxruntimers+0x10/0x10 [ 71.637915] ? updateprocess_times+0xfc/0x190 [ 71.637915] ? __pfxupdateprocesstimes+0x10/0x10 [ 71.637915] ? rawspinlockirq+0x80/0xe0 [ 71.637915] ? rawspinlockirq+0x80/0xe0 [ 71.637915] ? pfxrawspinlockirq+0x10/0x10 [ 71.637915] runtimersoftirq+0x141/0x240 [ 71.637915] ? __pfxrunsoftirq+0x141/0x240 [ 71.637915] ? __pfxruntimer_softirq+0x10/0x10 [ 71.637915] ? pfxhrtimerrunqueues+0x10/0x10 [ 71.637915] ? kvmclockgetcycles+0x18/0x30 [ 71.637915] ? ktimeget+0x60/0x140 [ 71.637915] handle_softirqs+0x1b8/0x5c0 [ 71.637915] ? __pfxhandlesoftirqs+0x10/0x10 [ 71.637915] irqexitrcu+0xaf/0xe0 [ 71.637915] sysvecapictimerinterrupt+0x6c/0x80 [ 71.637915] </IRQ> [ 71.637915] [ 71.637915] Allocated by task 39: [ 71.637915] kasansavestack+0x33/0x60 [ 71.637915] kasansave_track+0x14/0x30 [ 71.637915] __kasan_kmalloc+0x8f/0xa0 [ 71.637915] __kmallocnodetrackcallernoprof+0x195/0x420 [ 71.637915] devmkmalloc+0x74/0x1e0 [ 71.637915] appletbkbdprobe+0x37/0x3c0 [ 71.637915] hiddeviceprobe+0x2d1/0x680 [ 71.637915] reallyprobe+0x1c3/0x690 [ 71.637915] __driverprobedevice+0x247/0x300 [ 71.637915] driver_probedevice+0x49/0x210 [...] [ 71.637915] [ 71.637915] Freed by task 39: [ 71.637915] kasansavestack+0x33/0x60 [ 71.637915] kasansavetrack+0x14/0x30 [ 71.637915] kasansavefreeinfo+0x3b/0x60 [ 71.637915] __kasanslabfree+0x37/0x50 [ 71.637915] kfree+0xcf/0x360 [ 71.637915] devres_releasegroup+0x1f8/0x3c0 [ 71.637915] hiddeviceprobe+0x315/0x680 [ 71.637915] reallyprobe+0x1c3/0x690 [ 71.637915] __driverprobedevice+0x247/0x300 [ 71.637915] driverprobedevice+0x49/0x210 [...]

The root cause of the issue is that the timer is not disarmed on failure paths leading to it remaining active and accessing freed memory. To fix this call timerdeletesync() to deactivate the timer.

Another small issue is that timerdeletesync is called unconditionally in appletbkbdremove(), fix this by checking for a valid kbd->backlightdev before calling timerdelete_sync.