Listen to this Post
The vulnerability exists within the `appletb_kbd_probe` function of the Linux kernel’s HID driver for Apple Touch Bar keyboards. The driver allocates a structure (appletb_kbd kbd) to store keyboard data. If a specific backlight device is found, it initializes and arms an inactivity timer within this structure. The timer is set to expire after 60 seconds. If the probe function fails after the timer has been armed, the kernel’s device-managed memory system frees the `kbd` structure due to the error. However, the timer remains active. When the timer expires 60 seconds later, the kernel’s timer subsystem executes the callback function, which attempts to access the already-freed `kbd` structure. This results in a slab use-after-free bug, potentially leading to a kernel crash or other undefined behavior.
Platform: Linux Kernel
Version: Up to 6.16.0-rc2
Vulnerability : Use-After-Free
Severity: High
date: 07/25/2025
Prediction: Patch by 08/15/2025
What Undercode Say:
grep -r "appletb_kbd_probe" /usr/src/linux dmesg | grep "KASAN: slab-use-after-free" cat /proc/timer_list
// Code snippet from the vulnerable function
static int appletb_kbd_probe(struct hid_device hdev, ...) {
kbd = devm_kzalloc(...);
kbd->backlight_dev = backlight_device_get_by_name("appletb_backlight");
if (kbd->backlight_dev) {
timer_setup(&kbd->inactivity_timer, appletb_inactivity_timer, 0);
mod_timer(&kbd->inactivity_timer, jiffies + appletb_tb_dim_timeout HZ); // Timer armed
}
// ... If an error occurs here, kbd is freed but the timer remains active.
return error;
}
How Exploit:
Kernel crash
Denial-of-service
Potential code execution
Protection from this CVE
Update Linux kernel
Apply vendor patches
Disable affected hardware
Impact:
System instability
Kernel panic
Denial-of-service
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
