CVE-2026-46213

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: appletb-kbd: fix UAF in inactivity-timer cleanup path

Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in

appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to

both the probe close_hw error path and appletb_kbd_remove(), but the

way it was wired in left the inactivity timer reachable during driver

tear-down via two distinct windows.

Window A -- put_device() before timer_delete_sync():

put_device(&kbd->backlight_dev->dev);

timer_delete_sync(&kbd->inactivity_timer);

The inactivity_timer softirq reads kbd->backlight_dev and calls

backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a

concurrent hid_appletb_bl unbind drops the last devm reference

between these two calls, the backlight_device is freed and the

mutex_lock() touches freed memory.

Window B -- backlight cleanup before hid_hw_stop():

if (kbd->backlight_dev) {

timer_delete_sync(...);

put_device(...)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References