CVE-2026-46213: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46213 Overview

CVE-2026-46213 is a use-after-free (UAF) vulnerability in the Linux kernel's appletb-kbd HID driver, which handles the Touch Bar keyboard on Apple hardware. The flaw resides in the inactivity-timer cleanup path during driver tear-down. A prior fix (commit 38224c472a03) added timer_delete_sync(&kbd->inactivity_timer) to the probe error path and appletb_kbd_remove(), but ordered the calls incorrectly. Two distinct race windows allow the inactivity timer or a late HID .event callback to access freed backlight_device memory, producing a KASAN slab-use-after-free when backlight_device_set_brightness() calls mutex_lock(&ops_lock) on freed memory.

Critical Impact
A race between driver tear-down and concurrent hid_appletb_bl unbind or late HID event callbacks can dereference freed backlight device memory, leading to kernel memory corruption.

Affected Products

Linux kernel — drivers/hid/hid-appletb-kbd.c (HID appletb-kbd driver)
Systems running Apple Touch Bar hardware with the appletb-kbd driver loaded
Stable kernel branches receiving backports of commit 38224c472a03

Discovery Timeline

2026-05-28 - CVE-2026-46213 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46213

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the appletb-kbd driver's tear-down sequence. The previous fix introduced timer_delete_sync() calls but left two race windows open during cleanup.

Window A occurs because put_device(&kbd->backlight_dev->dev) runs before timer_delete_sync(&kbd->inactivity_timer). If a concurrent hid_appletb_bl unbind drops the last devm reference between these calls, the backlight_device is freed. The pending inactivity timer softirq then calls backlight_device_set_brightness(), which acquires mutex_lock(&ops_lock) on freed memory.

Window B occurs because backlight cleanup runs before hid_hw_close() and hid_hw_stop(). After timer_delete_sync() drains the softirq but before put_device() drops the reference, a late .event callback from the HID core, triggered by USB URB completion, reaches reset_inactivity_timer(). That function calls mod_timer() and re-arms the timer against the about-to-be-freed backlight_device.

Root Cause

The root cause is incorrect ordering of resource teardown operations. The driver releases the backlight device reference before stopping HID event delivery and before draining the timer softirq. This violates the invariant that all asynchronous accessors of an object must be quiesced before its reference is dropped.

Attack Vector

Triggering the race requires concurrent driver unbind operations on a system with the appletb-kbd driver bound to real Apple Touch Bar hardware. The race window is small and depends on precise timing between USB URB completion, softirq scheduling, and the hid_appletb_bl unbind path. Successful exploitation results in kernel memory corruption inside the SLAB allocator, observable as a KASAN slab-use-after-free in __mutex_lock reached through backlight_device_set_brightness and appletb_inactivity_timer.

The vulnerability is not remotely reachable. Exploitation requires local access and the ability to bind or unbind kernel drivers, typically restricted to privileged users.

Detection Methods for CVE-2026-46213

Indicators of Compromise

KASAN reports in dmesg containing BUG: KASAN: slab-use-after-free in __mutex_lock with a call trace including backlight_device_set_brightness and appletb_inactivity_timer.
Kernel oops or panic during appletb-kbd driver unbind or module removal on Apple Touch Bar systems.
Unexpected hid_appletb_bl unbind events correlated with appletb-kbd tear-down in kernel logs.

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch the use-after-free at runtime during driver stress testing.
Audit kernel versions against the fix commits 4db2af929279, 59a79938ca55, and 93d989e47bc3 to identify unpatched systems.
Monitor /var/log/kern.log and journalctl -k for crash signatures involving appletb_inactivity_timer and __mutex_lock.

Monitoring Recommendations

Track kernel package versions across Linux fleets, especially on Apple hardware, and flag hosts running pre-patch kernels.
Collect kernel crash dumps centrally and alert on panic signatures referencing appletb-kbd or backlight_device_set_brightness.
Review HID and backlight subsystem load/unload events for unusual unbind sequences during system maintenance windows.

How to Mitigate CVE-2026-46213

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable commit 4db2af929279, stable commit 59a79938ca55, and stable commit 93d989e47bc3.
Update affected Linux distributions to kernel versions that include the corrected tear-down ordering in appletb_kbd_remove().
Restrict the ability to bind and unbind kernel drivers to root-only contexts and audit any tooling that automates driver rebinding.

Patch Information

The fix reworks the tear-down sequence in appletb_kbd_remove() and the probe close_hw error path. hid_hw_close() and hid_hw_stop() now run before backlight cleanup, ensuring no further .event callback can re-arm the timer. Inside the if (kbd->backlight_dev) block, timer_delete_sync() runs before put_device(), draining the softirq before the final reference is dropped. Patches are available in the kernel git stable tree at the commits listed above.

Workarounds

Unload the hid-appletb-kbd module on systems where it is not required, using modprobe -r hid_appletb_kbd.
Avoid concurrent unbind of hid_appletb_bl and appletb-kbd during system maintenance until the patch is applied.
Limit physical and administrative access to Apple Touch Bar systems to prevent untrusted users from triggering driver bind/unbind operations.

bash

# Verify whether the appletb-kbd module is loaded and identify kernel version
uname -r
lsmod | grep appletb

# Optional: unload the module on systems that do not need Touch Bar support
sudo modprobe -r hid_appletb_kbd