{
  "cveId": "CVE-2026-46213",
  "url": "https://patchblox.com/security/cve/CVE-2026-46213",
  "summary": "CVE-2026-46213 is fixed in linux on 1 platform by DEBIAN-CVE-2026-46213 (version 7.0.9-1), released June 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  HID: appletb-kbd: fix UAF in inactivity-timer cl...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  HID: appletb-kbd: fix UAF in inactivity-timer cleanup path  Commit 38224c472a03 (\u0022HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe\u0022) added timer_delete_sync(\u0026kbd-\u003Einactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows.  Window A -- put_device() before timer_delete_sync():  \tput_device(\u0026kbd-\u003Ebacklight_dev-\u003Edev); \ttimer_delete_sync(\u0026kbd-\u003Einactivity_timer);  The inactivity_timer softirq reads kbd-\u003Ebacklight_dev and calls backlight_device_set_brightness() -\u003E mutex_lock(\u0026ops_lock).  If a concurrent hid_appletb_bl unbind drops the last devm reference between these two calls, the backlight_device is freed and the mutex_lock() touches freed memory.  Window B -- backlight cleanup before hid_hw_stop():  \tif (kbd-\u003Ebacklight_dev) { \t\ttimer_delete_sync(...); \t\tput_device(...); \t} \thid_hw_close(hdev); \thid_hw_stop(hdev);  Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run afterwards, so a late \u0022.event\u0022 callback from the HID core (USB URB completion on real Apple hardware) can arrive after timer_delete_sync() drained the softirq but before put_device() drops the reference.  That callback reaches reset_inactivity_timer(), which calls mod_timer() and re-arms the timer.  The freshly re-armed timer can then fire on the about-to-be-freed backlight_device.  Both windows produce the same KASAN slab-use-after-free:    BUG: KASAN: slab-use-after-free in __mutex_lock\u002B0x1aab/0x21c0   Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0   Call Trace:    \u003CIRQ\u003E    __mutex_lock    backlight_device_set_brightness    appletb_inactivity_timer    call_timer_fn    run_timer_softirq    handle_softirqs   Allocated by task N:    devm_backlight_device_register    appletb_bl_probe   Freed by task M:    (concurrent hid_appletb_bl unbind path)  Close both windows at once by reworking the tear-down in appletb_kbd_remove() and in the probe close_hw error path so that   1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup,     guaranteeing no further .event callback can fire and re-arm the     timer, and  2) inside the \u0022if (kbd-\u003Ebacklight_dev)\u0022 block, timer_delete_sync()     runs before put_device(), so the softirq is drained before the     final reference is dropped.",
  "published": "2026-05-28T10:16:36Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00124,
  "epssPercentile": 0.02126,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.0.9-1",
      "fix": "DEBIAN-CVE-2026-46213",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-46213",
      "released": "2026-06-24T14:07:24Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}