CVE-2025-38394 Overview
CVE-2025-38394 is a use-after-free vulnerability in the Linux kernel's appletb-kbd HID driver. The flaw stems from improper cleanup in the appletb_kbd_probe function when probe failure occurs after input_register_handler() succeeds. Device-managed memory for the input handler is freed on probe failure, but the handler remains registered in the global input_handler_list, leaving a dangling pointer. Any subsequent input device registration traverses this corrupted list, triggering memory corruption. The vulnerability affects Linux kernel versions 6.16-rc1 through 6.16-rc4 and is tracked under [CWE-787] (Out-of-Bounds Write).
Critical Impact
Local attackers with the ability to trigger driver probe failures and connect USB input devices can corrupt kernel memory, potentially achieving privilege escalation or arbitrary kernel code execution.
Affected Products
- Linux Kernel 6.16-rc1
- Linux Kernel 6.16-rc2
- Linux Kernel 6.16-rc3
- Linux Kernel 6.16-rc4
Discovery Timeline
- 2025-07-25 - CVE-2025-38394 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-38394
Vulnerability Analysis
The vulnerability resides in the appletb_kbd_probe function of the Apple Touch Bar keyboard HID driver. During probe, the driver allocates an input handler using device-managed memory (devm_* APIs) and registers it with input core through input_register_handler(). This registration adds the handler node to the kernel-wide input_handler_list, a structure traversed whenever a new input device is registered.
When probe fails after this registration, the device-managed allocation is automatically freed. However, the handler is not unregistered from input_handler_list, leaving a dangling pointer in a globally accessible kernel list. The freed memory can be reallocated for other purposes, corrupting kernel state.
The issue was detected by KASAN as a slab-use-after-free in input_attach_handler when a USB mouse was connected after a probe failure. The call chain traverses input_register_device → input_attach_handler, dereferencing the stale handler pointer.
Root Cause
The root cause is asymmetric cleanup between input_register_handler() and device-managed memory lifecycle. Device-managed memory is automatically freed on probe failure, but the corresponding input_unregister_handler() call is not invoked, leaving stale references in input_handler_list.
Attack Vector
Exploitation requires local access with the ability to trigger appletb_kbd_probe failure and subsequently connect an input device such as a USB mouse or keyboard. The traversal of the corrupted input_handler_list during input_register_device provides the primary corruption trigger. Skilled attackers could leverage heap grooming techniques to control the reallocated memory and achieve kernel code execution.
The vulnerability manifests through the input_attach_handler code path. See the kernel commit log for technical details of the corrected cleanup sequence.
Detection Methods for CVE-2025-38394
Indicators of Compromise
- KASAN reports containing slab-use-after-free in input_attach_handler in kernel logs (dmesg, /var/log/kern.log).
- Unexplained kernel oopses or panics occurring after USB input device hotplug events.
- appletb_kbd_probe failure messages followed by system instability on Apple hardware with Touch Bar keyboards.
Detection Strategies
- Monitor kernel logs for probe-failure messages from the appletb-kbd driver combined with subsequent input subsystem faults.
- Enable KASAN in test and staging kernels to surface use-after-free conditions during driver load testing.
- Audit installed kernel versions across the fleet to identify systems running vulnerable 6.16-rc release candidates.
Monitoring Recommendations
- Collect and centralize kernel ring buffer output for anomaly identification on Linux endpoints.
- Alert on kernel crash artifacts including kdump files, pstore entries, and systemd-coredump events on affected systems.
- Track USB device enumeration events on Apple hardware to correlate with driver failure signals.
How to Mitigate CVE-2025-38394
Immediate Actions Required
- Upgrade to a Linux kernel build containing commits 6ad40b07e15c29712d9a4b8096914ccd82e3fc17 or c80f2b047d5cc42fbd2dff9d1942d4ba7545100f.
- Avoid running Linux kernel 6.16-rc1 through 6.16-rc4 in production, particularly on Apple hardware equipped with Touch Bar keyboards.
- Restrict physical and local console access on systems where the fix cannot be applied immediately.
Patch Information
The fix ensures the input handler is properly unregistered via input_unregister_handler() when probe fails after registration. The patch is available in the upstream kernel via commit 6ad40b07 and commit c80f2b04.
Workarounds
- Blacklist the appletb-kbd kernel module on systems that do not require Apple Touch Bar keyboard support.
- Disable USB hotplug on affected systems by restricting udev rules where operationally feasible.
- Limit local user accounts and enforce least privilege to reduce the attack surface for local exploitation.
# Blacklist the vulnerable driver module
echo "blacklist appletb-kbd" | sudo tee /etc/modprobe.d/blacklist-appletb-kbd.conf
sudo update-initramfs -u
# Verify running kernel version
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
