FKIE_CVE-2026-46213

Vulnerability from fkie_nvd - Published: 2026-05-28 10:16 - Updated: 2026-06-10 19:16
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows. Window A -- put_device() before timer_delete_sync(): put_device(&kbd->backlight_dev->dev); timer_delete_sync(&kbd->inactivity_timer); The inactivity_timer softirq reads kbd->backlight_dev and calls backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a concurrent hid_appletb_bl unbind drops the last devm reference between these two calls, the backlight_device is freed and the mutex_lock() touches freed memory. Window B -- backlight cleanup before hid_hw_stop(): if (kbd->backlight_dev) { timer_delete_sync(...); put_device(...); } hid_hw_close(hdev); hid_hw_stop(hdev); Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run afterwards, so a late ".event" callback from the HID core (USB URB completion on real Apple hardware) can arrive after timer_delete_sync() drained the softirq but before put_device() drops the reference. That callback reaches reset_inactivity_timer(), which calls mod_timer() and re-arms the timer. The freshly re-armed timer can then fire on the about-to-be-freed backlight_device. Both windows produce the same KASAN slab-use-after-free: BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0 Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0 Call Trace: <IRQ> __mutex_lock backlight_device_set_brightness appletb_inactivity_timer call_timer_fn run_timer_softirq handle_softirqs Allocated by task N: devm_backlight_device_register appletb_bl_probe Freed by task M: (concurrent hid_appletb_bl unbind path) Close both windows at once by reworking the tear-down in appletb_kbd_remove() and in the probe close_hw error path so that 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup, guaranteeing no further .event callback can fire and re-arm the timer, and 2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync() runs before put_device(), so the softirq is drained before the final reference is dropped.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4db2af929279c799b5653a39eb0795c72baffca4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/59a79938ca5541fe55d675304116b7ea684afef0Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/93d989e47bc316c793a69c6a332e053c90e29f02Patch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 7.1
linux linux_kernel 7.1
linux linux_kernel 7.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BEF58D78-987C-49EA-8F22-0EF0F89F0A2E",
              "versionEndExcluding": "6.16",
              "versionStartIncluding": "6.15.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8E2D8D4-D9B3-4E07-94C2-1523EED060E3",
              "versionEndExcluding": "6.18.32",
              "versionStartIncluding": "6.16.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33ACA10B-B260-46EA-BD50-70EBE5097672",
              "versionEndExcluding": "7.0.9",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*",
              "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "7A9C2DE5-43B8-4D73-BDB5-EA55C7671A52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: fix UAF in inactivity-timer cleanup path\n\nCommit 38224c472a03 (\"HID: appletb-kbd: fix slab use-after-free bug in\nappletb_kbd_probe\") added timer_delete_sync(\u0026kbd-\u003einactivity_timer) to\nboth the probe close_hw error path and appletb_kbd_remove(), but the\nway it was wired in left the inactivity timer reachable during driver\ntear-down via two distinct windows.\n\nWindow A -- put_device() before timer_delete_sync():\n\n\tput_device(\u0026kbd-\u003ebacklight_dev-\u003edev);\n\ttimer_delete_sync(\u0026kbd-\u003einactivity_timer);\n\nThe inactivity_timer softirq reads kbd-\u003ebacklight_dev and calls\nbacklight_device_set_brightness() -\u003e mutex_lock(\u0026ops_lock).  If a\nconcurrent hid_appletb_bl unbind drops the last devm reference\nbetween these two calls, the backlight_device is freed and the\nmutex_lock() touches freed memory.\n\nWindow B -- backlight cleanup before hid_hw_stop():\n\n\tif (kbd-\u003ebacklight_dev) {\n\t\ttimer_delete_sync(...);\n\t\tput_device(...);\n\t}\n\thid_hw_close(hdev);\n\thid_hw_stop(hdev);\n\nEven after Window A is closed, hid_hw_close()/hid_hw_stop() still run\nafterwards, so a late \".event\" callback from the HID core (USB URB\ncompletion on real Apple hardware) can arrive after\ntimer_delete_sync() drained the softirq but before put_device() drops\nthe reference.  That callback reaches reset_inactivity_timer(), which\ncalls mod_timer() and re-arms the timer.  The freshly re-armed timer\ncan then fire on the about-to-be-freed backlight_device.\n\nBoth windows produce the same KASAN slab-use-after-free:\n\n  BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0\n  Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0\n  Call Trace:\n   \u003cIRQ\u003e\n   __mutex_lock\n   backlight_device_set_brightness\n   appletb_inactivity_timer\n   call_timer_fn\n   run_timer_softirq\n   handle_softirqs\n  Allocated by task N:\n   devm_backlight_device_register\n   appletb_bl_probe\n  Freed by task M:\n   (concurrent hid_appletb_bl unbind path)\n\nClose both windows at once by reworking the tear-down in\nappletb_kbd_remove() and in the probe close_hw error path so that\n\n 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup,\n    guaranteeing no further .event callback can fire and re-arm the\n    timer, and\n 2) inside the \"if (kbd-\u003ebacklight_dev)\" block, timer_delete_sync()\n    runs before put_device(), so the softirq is drained before the\n    final reference is dropped."
    }
  ],
  "id": "CVE-2026-46213",
  "lastModified": "2026-06-10T19:16:24.720",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-05-28T10:16:36.947",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4db2af929279c799b5653a39eb0795c72baffca4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/59a79938ca5541fe55d675304116b7ea684afef0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/93d989e47bc316c793a69c6a332e053c90e29f02"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.