CVE-2026-64363

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

HID: appleir: fix UAF on pending key_up_timer in remove()

appleir_remove() runs hid_hw_stop() before timer_delete_sync().

hid_hw_stop() synchronously unregisters the HID input device via

hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),

which drops the last reference and frees the underlying input_dev when

no userspace handle holds it open.

key_up_tick() reads appleir->input_dev and calls input_report_key() /

input_sync() on it. The timer is armed from appleir_raw_event() with

a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a

key was pressed shortly before the device is disconnected, the timer

can fire after hid_hw_stop() has freed input_dev but before the

teardown drains it.

A simple reorder is not sufficient. Putting the timer drain first

still leaves a window where a USB URB completion (raw_event) running

during hid_hw_stop() can call mod_timer() and re-arm the timer,

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References