Reference Leak in appletb_kbd Backlight Device in Linux Kernel

CVE-2025-38235

What is CVE-2025-38235?

The appletb_kbd module in the Linux kernel contains a vulnerability that leads to a reference leak within the backlight device management. During the initialization process (appletb_kbd_probe), the module attempts to acquire a backlight device using its name 'appletb_backlight'. Although the corresponding reference count is incremented when the device is found, it is never decremented, which results in a reference count build-up over time. To mitigate this issue, the fix implements a mechanism to decrement the reference count on both removal and probe failure, ensuring proper management of device references and prevents potential resource exhaustion.

References