{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-38378 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38378 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38378 and fix it if it is affected.\n\nWhat it is: CVE-2025-38378 is a high-severity use after free vulnerability in Linux kernel, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38378 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38378/ (Markdown: https://insights.sbomify.com/CVE-2025-38378/index.md)","id":"CVE-2025-38378","markdown":"https://insights.sbomify.com/CVE-2025-38378/index.md","name":"CVE-2025-38378","record":{"aliases":["BELL-CVE-2025-38378","GHSA-j6m8-x4v6-3fgh","UBUNTU-CVE-2025-38378"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel's Apple Touch Bar driver allows local attackers to potentially execute code or escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe\n\nIn probe appletb_kbd_probe() a \"struct appletb_kbd *kbd\" is allocated\nvia devm_kzalloc() to store touch bar keyboard related data.\nLater on if backlight_device_get_by_name() finds a backlight device\nwith name \"appletb_backlight\" a timer (kbd-\u003einactivity_timer) is setup\nwith appletb_inactivity_timer() and the timer is armed to run after\nappletb_tb_dim_timeout (60) seconds.\n\nA use-after-free is triggered when failure occurs after the timer is\narmed. This ultimately means probe failure occurs and as a result the\n\"struct appletb_kbd *kbd\" which is device managed memory is freed.\nAfter 60 seconds the timer will have expired and __run_timers will\nattempt to access the timer (kbd-\u003einactivity_timer) however the kdb\nstructure has been freed causing a use-after free.\n\n[   71.636938] ==================================================================\n[   71.637915] BUG: KASAN: slab-use-after-free in __run_timers+0x7ad/0x890\n[   71.637915] Write of size 8 at addr ffff8881178c5958 by task swapper/1/0\n[   71.637915]\n[   71.637915] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc2-00318-g739a6c93cc75-dirty #12 PREEMPT(voluntary)\n[   71.637915] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n[   71.637915] Call Trace:\n[   71.637915]  \u003cIRQ\u003e\n[   71.637915]  dump_stack_lvl+0x53/0x70\n[   71.637915]  print_report+0xce/0x670\n[   71.637915]  ? __run_timers+0x7ad/0x890\n[   71.637915]  kasan_report+0xce/0x100\n[   71.637915]  ? __run_timers+0x7ad/0x890\n[   71.637915]  __run_timers+0x7ad/0x890\n[   71.637915]  ? __pfx___run_timers+0x10/0x10\n[   71.637915]  ? update_process_times+0xfc/0x190\n[   71.637915]  ? __pfx_update_process_times+0x10/0x10\n[   71.637915]  ? _raw_spin_lock_irq+0x80/0xe0\n[   71.637915]  ? _raw_spin_lock_irq+0x80/0xe0\n[   71.637915]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n[   71.637915]  run_timer_softirq+0x141/0x240\n[   71.637915]  ? __pfx_run_timer_softirq+0x10/0x10\n[   71.637915]  ? __pfx___hrtimer_run_queues+0x10/0x10\n[   71.637915]  ? kvm_clock_get_cycles+0x18/0x30\n[   71.637915]  ? ktime_get+0x60/0x140\n[   71.637915]  handle_softirqs+0x1b8/0x5c0\n[   71.637915]  ? __pfx_handle_softirqs+0x10/0x10\n[   71.637915]  irq_exit_rcu+0xaf/0xe0\n[   71.637915]  sysvec_apic_timer_interrupt+0x6c/0x80\n[   71.637915]  \u003c/IRQ\u003e\n[   71.637915]\n[   71.637915] Allocated by task 39:\n[   71.637915]  kasan_save_stack+0x33/0x60\n[   71.637915]  kasan_save_track+0x14/0x30\n[   71.637915]  __kasan_kmalloc+0x8f/0xa0\n[   71.637915]  __kmalloc_node_track_caller_noprof+0x195/0x420\n[   71.637915]  devm_kmalloc+0x74/0x1e0\n[   71.637915]  appletb_kbd_probe+0x37/0x3c0\n[   71.637915]  hid_device_probe+0x2d1/0x680\n[   71.637915]  really_probe+0x1c3/0x690\n[   71.637915]  __driver_probe_device+0x247/0x300\n[   71.637915]  driver_probe_device+0x49/0x210\n[...]\n[   71.637915]\n[   71.637915] Freed by task 39:\n[   71.637915]  kasan_save_stack+0x33/0x60\n[   71.637915]  kasan_save_track+0x14/0x30\n[   71.637915]  kasan_save_free_info+0x3b/0x60\n[   71.637915]  __kasan_slab_free+0x37/0x50\n[   71.637915]  kfree+0xcf/0x360\n[   71.637915]  devres_release_group+0x1f8/0x3c0\n[   71.637915]  hid_device_probe+0x315/0x680\n[   71.637915]  really_probe+0x1c3/0x690\n[   71.637915]  __driver_probe_device+0x247/0x300\n[   71.637915]  driver_probe_device+0x49/0x210\n[...]\n\nThe root cause of the issue is that the timer is not disarmed\non failure paths leading to it remaining active and accessing\nfreed memory. To fix this call timer_delete_sync() to deactivate\nthe timer.\n\nAnother small issue is that timer_delete_sync is called\nunconditionally in appletb_kbd_remove(), fix this by checking\nfor a valid kbd-\u003ebacklight_dev before calling timer_delete_sync.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe","id":"CVE-2025-38378","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"smb: client: fix warning when reconnecting channel","id":"CVE-2025-38379"},"packages":[],"prev":{"headline":"rose: fix dangling neighbour pointers in rose_rt_device_down()","id":"CVE-2025-38377"},"products":["Linux"],"published":"2025-07-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel's Apple Touch Bar driver allows local attackers to potentially execute code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2025-38378/"}