CVE-2025-71073: Input: lkkbd - disable pending work before freeing device
In the Linux kernel, the following vulnerability has been resolved:
Input: lkkbd - disable pending work before freeing device
lkkbdinterrupt() schedules lk->tq via schedulework(), and the work handler lkkbdreinit() dereferences the lkkbd structure and its serio/inputdev fields.
lkkbddisconnect() and error paths in lkkbdconnect() free the lkkbd structure without preventing the reinit work from being queued again until serioclose() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free.
Use disableworksync() instead of cancelworksync() to ensure the reinit work cannot be re-queued, and call it both in lkkbddisconnect() and in lkkbdconnect() error paths after serioopen().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the lkkbd driver, disable pending work before freeing the device by using disable_work_sync() instead of cancel_work_sync(), so the work handler cannot run after the lkkbd structure is freed.
Linux kernel (lkkbd driver) disable pending work before freeing device (use disable_work_sync() instead of cancel_work_sync()) = disable_work_sync() - Configuration
In lkkbd_disconnect() and in the lkkbd_connect() error paths after serio_open(), call lkkbd_reinit() to ensure the lkkbd work is handled correctly (so the reinit work is not re-queued until serio_close() returns).
Linux kernel (lkkbd driver) Work reinit queuing in disconnect/disconnect and connect error paths = call lkkbd_reinit() both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71073?
CVE-2025-71073 has been categorized with a moderate severity level due to potential impacts on system stability.
How do I fix CVE-2025-71073?
To fix CVE-2025-71073, it is recommended to apply the latest patches provided by the Linux kernel developers.
Which versions of the Linux kernel are affected by CVE-2025-71073?
CVE-2025-71073 affects multiple versions of the Linux kernel specifically related to the input lkkbd functionality.
What type of vulnerability is CVE-2025-71073?
CVE-2025-71073 is classified as a resource management vulnerability that can lead to system crashes or instability.
What are the potential impacts of CVE-2025-71073?
The potential impacts of CVE-2025-71073 include crashes or unintended behavior of the input device due to improper management of pending work.