CVE-2025-71073: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71073 is a use-after-free vulnerability in the Linux kernel's lkkbd (LK keyboard) input driver. It was published on January 13, 2026, and affects Linux kernel versions from 2.6.12.1 up to (excluding) 6.12.64, versions 6.13 through 6.18.3 (exclusive), and 6.19 release candidates rc1–rc8. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) with a local attack vector (Feedly, kernel.org).

The root cause is a use-after-free condition (CWE-416) in the lkkbd driver's work scheduling logic. lkkbd_interrupt() schedules the lk->tq work item via schedule_work(), and the work handler lkkbd_reinit() subsequently dereferences the lkkbd structure along with its serio and input_dev fields. However, both lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd structure without preventing the reinit work from being re-queued — specifically, this window exists until serio_close() returns. The fix replaces cancel_work_sync() with disable_work_sync() in both lkkbd_disconnect() and the lkkbd_connect() error paths after serio_open(), ensuring the work cannot be re-queued after the structure is freed (Feedly, kernel.org).

Successful exploitation could result in kernel memory corruption, system crash (denial of service), or arbitrary code execution with kernel privileges. An attacker with low-level local access could trigger the race condition by causing the interrupt handler to schedule work during device disconnection or connection error paths, leading to high confidentiality, integrity, and availability impacts. The scope is limited to the local system, but kernel-level code execution could enable full privilege escalation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and the ability to trigger a race condition between interrupt handling and device teardown (Feedly).

Upgrade to a patched Linux kernel version: 6.12.64 or later for the 6.12.x stable series, or 6.18.3 or later for the 6.13+ series. Patches are available via the upstream kernel stable tree (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3). Ubuntu security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 address this issue for affected Ubuntu releases (Ubuntu USN-8177-1, Ubuntu USN-8183-1). As a temporary workaround on systems that do not use LK-series keyboards, the lkkbd kernel module can be blacklisted to prevent the driver from loading.

The vulnerability has been tracked by standard Linux distribution security channels, with Ubuntu issuing multiple security notices (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1) and the Yocto Project security mailing list referencing it in several advisories. No notable independent researcher commentary or significant social media discussion has been observed beyond routine distribution patch tracking (Ubuntu USN-8177-1, Ubuntu USN-8183-1).