CVE-2025-71073

Input: lkkbd - disable pending work before freeing device

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: Oct 30, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Input: lkkbd - disable pending work before freeing device

lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields.

lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being queued again until serio_close() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free.

Use disable_work_sync() instead of cancel_work_sync() to ensure the reinit work cannot be re-queued, and call it both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fb76f871d6155c52ccc0401bbde77dd20b83d0c1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8cf889d45bbc8477206dda78c8f757ea8ff68213Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3a7cd1397c209076c371d53bf39a55c138f62342Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cffc4e29b1e2d44ab094cf142d7c461ff09b9104Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e58c88f0cb2d8ed89de78f6f17409d29cfab6c5cAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fb76f871d6155c52ccc0401bbde77dd20b83d0c1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8cf889d45bbc8477206dda78c8f757ea8ff68213Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3a7cd1397c209076c371d53bf39a55c138f62342Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cffc4e29b1e2d44ab094cf142d7c461ff09b9104Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e58c88f0cb2d8ed89de78f6f17409d29cfab6c5cAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.