CVE-2026-46202: Linux Kernel hid-appletb-kbd Mutex Context Bug—Medium Severity Denial of Service

Technical summary

The vulnerability stems from a context-switching violation in hid-appletb-kbd's brightness management. The appletb_inactivity_timer() callback executes as a timer_list handler in softirq context and invokes backlight_device_set_brightness(), which attempts mutex_lock() on backlight_device->ops_lock—an illegal operation from atomic context. Similarly, reset_inactivity_timer() is called from hid event handlers running in URB completion (IRQ) and input dispatch (softirq) contexts, and when restoring brightness after dim/off states, it also calls backlight_device_set_brightness() directly from atomic context. The resolution converts the inactivity timer to a delayed_work structure that executes in process context, and adds a separate work_struct for brightness restoration, eliminating the atomic-context mutex acquisition. Both work items are cancelled synchronously during driver teardown.

Business impact

This is a kernel stability issue affecting systems with Apple Touch Bar keyboards on Linux. The primary impact is system reliability: the bug triggers BUG warnings and could lead to kernel panics, unexpected hangs, or scheduler warnings that degrade user experience and system availability. For enterprise deployments or mission-critical systems running Linux on compatible hardware, unpatched kernels may exhibit sporadic crashes during keyboard use. The issue does not expose data or enable privilege escalation; the impact is functional availability of the keyboard and overall system stability.

Affected systems

The vulnerability affects the Linux kernel's hid-appletb-kbd driver, which supports Apple Touch Bar keyboard input and brightness control on systems running compatible Linux distributions. This includes Linux-based systems with Apple hardware using the Touch Bar (primarily newer MacBooks running Linux in dual-boot or natively). The vulnerability is present in kernels containing the affected code path and will manifest on any system that uses the appletb-kbd driver actively (particularly when keyboard inactivity timeouts or brightness restoration events occur).

Exploitability

This is a kernel panic/denial-of-service vector rather than a remote or privilege-escalation vulnerability. Exploitation requires local system access and depends on triggering keyboard inactivity or user-activity events while the driver is loaded. An unprivileged user cannot remotely or easily trigger the bug; a local attacker with keyboard access can induce brightness state changes or wait for inactivity timeouts to occur, potentially causing kernel warnings or instability. The CVSS 5.5 MEDIUM score reflects the local attack vector, low attack complexity, and denial-of-service impact with no confidentiality or integrity breach.

Remediation

Update to a patched Linux kernel that includes the fix converting inactivity timer and brightness restoration to workqueue-based execution. Verify the kernel version in your distribution's advisory against the vendor's patches. Alternatively, users dependent on the Touch Bar keyboard may disable the driver or avoid extended inactivity to reduce the likelihood of triggering the bug until patched, though this is a workaround rather than a fix. The patch is non-invasive and preserves all existing behavior and timing semantics.

Patch guidance

Check your Linux distribution's kernel security advisory for the version that incorporates the hid-appletb-kbd fix. The fix involves converting appletb_inactivity_timer from a timer_list callback to a delayed_work handler (appletb_inactivity_work), adding a restore_brightness_work structure, and modifying reset_inactivity_timer() to schedule the work instead of calling backlight_device_set_brightness() directly. When a patched kernel is released, standard kernel update procedures (apt, yum, etc.) will deliver the fix. Test after upgrade to confirm the keyboard and backlight functionality operate without warnings in kernel logs.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for the specific error pattern: 'BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591' combined with stack traces mentioning appletb_inactivity_timer(), reset_inactivity_timer(), or backlight_device_set_brightness(). Systems exhibiting these warnings are running vulnerable code. Check kernel version and hid-appletb-kbd driver status with 'uname -r' and 'lsmod | grep appletb' to confirm the driver is loaded. Correlate log timestamps with keyboard inactivity or brightness change events to confirm the bug is being triggered.

Why prioritize this

Prioritize based on deployment model: if your organization supports Apple hardware running Linux, or if you operate systems with Touch Bar keyboards, this ranks as medium-priority for patching because it affects local system stability. For most enterprise environments without Apple Touch Bar hardware, this is lower priority but should still be included in regular kernel patching cycles. The fact that it is not currently on the CISA KEV list suggests active exploitation in the wild is not documented, reducing urgency. However, any Linux system running an affected kernel version should patch during planned maintenance windows to prevent unexpected kernel warnings or crashes.

Risk score, explained

The CVSS 5.5 MEDIUM score reflects: local attack vector (requires system access), low attack complexity (keyboard events are routine), low privileges required, and high availability impact (denial of service via kernel panic or warning floods). No confidentiality or integrity impact offsets the denial-of-service risk. The score appropriately captures a stability issue that is annoying and potentially disruptive but not exploitable for data theft or privilege escalation. For organizations with Apple Touch Bar Linux deployments, the practical risk may be higher due to system stability implications.

Frequently asked questions