CVE-2026-46213: Linux Kernel appletb-kbd Use-After-Free Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-46213 is a use-after-free (UAF) vulnerability in the appletb-kbd HID driver's inactivity timer cleanup path. The vulnerability arises from a race condition with two distinct windows. Window A occurs when put_device() is called before timer_delete_sync(), allowing the inactivity_timer softirq to read a freed kbd->backlight_dev and call backlight_device_set_brightness(), which attempts to acquire a mutex on already-freed memory. Window B allows a late .event callback from the HID core to arrive after timer_delete_sync() completes but before hid_hw_stop(), permitting the callback to call reset_inactivity_timer() and re-arm the timer on the about-to-be-freed backlight device. The fix reorders teardown operations so that hid_hw_close()/hid_hw_stop() execute before backlight cleanup, and timer_delete_sync() runs before put_device() to ensure the softirq is drained before the final reference is dropped.

Business impact

This vulnerability affects system stability on deployments running affected Linux kernel versions with Apple keyboards attached or supported. Exploitation could lead to kernel panics, system hangs, or potential privilege escalation in multi-tenant or shared-access environments. Organizations relying on Apple hardware with Linux must prioritize patching to prevent denial of service and maintain system availability. The local-access requirement limits blast radius but does not eliminate risk in shared hosting, containerized, or multi-user environments.

Affected systems

Linux kernel systems with the appletb-kbd HID driver compiled or loaded. The vulnerability specifically affects driver initialization and teardown paths, making any system that loads this driver vulnerable during those critical transitions. This primarily impacts Apple hardware running Linux, including MacBook devices with integrated keyboards. The presence of the driver does not require active keyboard input; vulnerability windows are triggered during driver load/unload operations.

Exploitability

Exploitation requires local system access and the ability to trigger driver unload sequences or probe-path errors. An unprivileged local user can force driver reload through sysfs or by unbinding/rebinding the device, creating the race window. No user interaction is required beyond these administrative actions. The race condition is timing-dependent, which may affect reliability across different hardware configurations and kernel compile options. Public exploit code has not been added to the Known Exploited Vulnerabilities (KEV) catalog as of the information cutoff.

Remediation

Apply a patched kernel version that reorders the appletb-kbd driver teardown sequence to close both race windows. Verify against the vendor advisory or kernel security bulletin for the specific patched version applicable to your kernel series. Systems should prioritize applying updates to the affected kernel components as soon as patches are available through distribution channels. In interim mitigation, avoid frequent driver reload cycles and monitor for kernel UAF messages (KASAN output) in system logs.

Patch guidance

Consult the Linux kernel security advisory and your distribution's update channels for patched kernel versions addressing this vulnerability. Verify that the patch incorporates both race-condition fixes: reordering hid_hw_close()/hid_hw_stop() before backlight cleanup, and ensuring timer_delete_sync() precedes put_device(). Test patched kernels in a non-production environment before deployment. Consider enabling KASAN in development/staging environments to catch similar UAF issues early.

Detection guidance

Monitor kernel logs for KASAN slab-use-after-free messages mentioning __mutex_lock, backlight_device_set_brightness, or appletb_inactivity_timer. Kernel crash dumps referencing appletb-kbd driver teardown or the inactivity timer are indicative. Use CONFIG_KASAN if available to increase likelihood of catching the condition. Correlate crashes with driver reload/unbind events to identify exploitation attempts. EDR and kernel-level logging tools should flag processes triggering HID driver unload sequences in rapid succession.

Why prioritize this

HIGH severity (CVSS 7.8) due to local kernel code execution potential, but mitigated by local-access requirement and lack of public exploit availability. Prioritize based on: (1) whether your systems run Apple hardware with this driver active, (2) frequency of driver unload operations in your environment, and (3) whether unprivileged users can trigger driver reload. Multi-user and containerized environments should prioritize higher; single-user desktops may defer slightly, but should not delay indefinitely.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector Local (AV:L) — requires local system access; Attack Complexity Low (AC:L) — race window is reliably triggerable; Privileges Required Low (PR:L) — unprivileged user can unbind/rebind drivers; User Interaction None (UI:N) — no user action needed beyond administrative commands; Scope Unchanged (S:U); Confidentiality, Integrity, Availability all High (C:H/I:H/A:H) — kernel memory corruption enables data theft, system modification, and denial of service. The score appropriately reflects kernel-level impact despite local-only access.

Frequently asked questions