Input: lkkbd - disable pending work before freeing device
Published Jan 13, 2026
7.8
HIGHCVSS 3.1
EPSS 0.14%
Description
lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields.
lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being queued again until serio_close() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free.
Use disable_work_sync() instead of cancel_work_sync() to ensure the reinit work cannot be re-queued, and call it both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open().
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 2.6.12StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<2.6.12
- Version 6.12.64StatusunaffectedConstraints<=6.12.*
- Version 6.18.3StatusunaffectedConstraints<=6.18.*
- Version 6.19StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
- ≥ 2.6.12.1 · < 6.12.64
- ≥ 6.13 · < 6.18.3
- 2.6.12
- 2.6.12
- 2.6.12
- 2.6.12
- 2.6.12
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
- 6.19
No data.
Red Hat Enterprise Linux 10
kernel
Not affected
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Jan–Oct 2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.14% (0.00145) | 3.19th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.12% (0.00124) | 2.47th | v5 (v2026.06.15) |
| Jan 14, 2026 | 0.02% (0.00017) | 3.13th | v4 (v2025.03.14) |
References (8)
- https://access.redhat.com/security/cve/CVE-2025-71073 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2429077 Issue Tracking
- https://git.kernel.org/stable/c/3a7cd1397c209076c371d53bf39a55c138f62342 Patch
- https://git.kernel.org/stable/c/cffc4e29b1e2d44ab094cf142d7c461ff09b9104 Patch
- https://git.kernel.org/stable/c/e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c Patch
- https://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71073-b002@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2025-71073
- https://www.cve.org/CVERecord?id=CVE-2025-71073
Change history (0)
No recorded changes yet.