CVE-2025-38394

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: appletb-kbd: fix memory corruption of input_handler_list

In appletb_kbd_probe an input handler is initialised and then registered

with input core through input_register_handler(). When this happens input

core will add the input handler (specifically its node) to the global

input_handler_list. The input_handler_list is central to the functionality

of input core and is traversed in various places in input core. An example

of this is when a new input device is plugged in and gets registered with

input core.

The input_handler in probe is allocated as device managed memory. If a

probe failure occurs after input_register_handler() the input_handler

memory is freed, yet it will remain in the input_handler_list. This

effectively means the input_handler_list contains a dangling pointer

to data belonging to a freed input handler.

This causes an issue when any other input device is plugged in - in my

case I had an old Pi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References