CVE-2026-64363: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64363 Overview

CVE-2026-64363 is a use-after-free vulnerability in the Linux kernel HID: appleir driver. The flaw exists in the driver's remove path, where appleir_remove() calls hid_hw_stop() before timer_delete_sync(). The hid_hw_stop() call synchronously unregisters the HID input device and frees the underlying input_dev structure. A pending key_up_timer can then fire and dereference the freed input_dev, triggering the use-after-free. The bug has been present since the driver was introduced and is structurally similar to commit 4db2af929279 which fixed a comparable issue in HID: appletb-kbd.

Critical Impact
A race between USB URB completion and device teardown allows the key_up_tick() callback and appleir_raw_event() handlers to dereference a freed input_dev, resulting in kernel memory corruption.

Affected Products

Linux kernel — drivers/hid/hid-appleir.c (appleir HID driver)
All kernel versions since the appleir driver was introduced
Stable kernel branches referenced by the eight backport commits listed in the advisory

Discovery Timeline

2026-07-25 - CVE-2026-64363 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64363

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the Linux kernel's Apple infrared HID driver. appleir_remove() invokes hid_hw_stop(), which triggers a chain of calls: hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(). When no userspace handle holds the device open, this drops the last reference on input_dev and frees it.

The driver arms key_up_timer from appleir_raw_event() on every keydown and key-repeat report, with a HZ/8 (~125 ms) timeout. If a key was pressed shortly before device disconnection, the timer callback key_up_tick() can fire after input_dev has been freed but before teardown completes. The callback then calls input_report_key() and input_sync() on freed memory.

A simple reorder of timer_delete_sync() before hid_hw_stop() is insufficient. A concurrent USB URB completion running appleir_raw_event() during hid_hw_stop() can call mod_timer() and re-arm the timer, which subsequently fires against freed memory. The same window also allows raw_event() to reach key_up(), key_down(), and battery_flat(), all of which dereference appleir->input_dev.

Root Cause

The root cause is an ordering and synchronization defect in the driver's teardown sequence. The lifetime of appleir->input_dev is not coordinated with the timer or with in-flight URB completions. No flag or barrier prevents appleir_raw_event() from arming the timer or dereferencing the input device while hid_hw_stop() is releasing it. Additionally, the keyrepeat and flatbattery branches of appleir_raw_event() previously operated without holding the driver spinlock, leaving a pre-existing read-side race on appleir->current_key.

Attack Vector

Exploitation requires local physical or logical control over Apple infrared HID device connect and disconnect events, combined with the ability to induce raw input reports at the moment of teardown. An attacker who can trigger the race window can cause the kernel to dereference freed slab memory, leading to kernel panic or, with heap grooming, potential memory corruption. The vulnerability is not remotely exploitable over a network.

The upstream fix introduces a removing flag on struct appleir, gated by the existing spinlock. appleir_remove() sets the flag under the lock and then calls timer_shutdown_sync(), which both drains any in-flight callback and permanently disables further mod_timer() calls. Both appleir_raw_event() and key_up_tick() bail out early when the flag is set. See the Linux Kernel Commit Reference for the patch source.

Detection Methods for CVE-2026-64363

Indicators of Compromise

Kernel oops or panic messages referencing key_up_tick, input_report_key, or input_sync originating from the hid-appleir module
KASAN reports flagging use-after-free reads on input_dev structures during HID device removal
Unexpected system crashes correlated with connect and disconnect events on Apple infrared receivers

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free accesses in the appleir driver during device removal stress tests
Audit loaded kernel modules with lsmod | grep appleir to identify systems where the vulnerable driver is present
Correlate dmesg output with USB hotplug events using udevadm monitor to identify race-window conditions

Monitoring Recommendations

Ship kernel logs and USB subsystem events to a centralized log platform for review of oops signatures involving the HID input stack
Track kernel version inventory across the fleet to identify hosts running unpatched stable branches
Alert on repeated hid-appleir module load and unload sequences, which can indicate probing of the race window

How to Mitigate CVE-2026-64363

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix for the appleir remove path
On systems where the Apple infrared receiver is not required, blacklist the hid-appleir module to eliminate exposure
Restrict physical access to USB and Bluetooth interfaces on affected systems to reduce the attack surface

Patch Information

The fix is distributed across eight stable branch commits. Key references include commit 37a52c61d4f78153c38ae1f7491dfcc8ac828dcf, commit 05e3decc55d1deca9410e0eb36466651fcbe57a5, commit 3755f6e25776b8b12ddf062f9b573f05090e4034, commit 3d30a0bb0e79621ae921b487835c56198adfafa3, commit 6b0838e86da88b1d3bff86f19761ff25af73eaca, commit 75fe87e19d8aff81eb2c64d15d244ab8da4de945, commit 89ef67359672bf4cd6921524e39f61648fe38c0f, and commit b363d964ca829c1761c9f04188dfa28f90b0f2d4. The patch adds a removing flag and replaces timer_delete_sync() with timer_shutdown_sync().

Workarounds

Blacklist the driver by adding blacklist hid-appleir to /etc/modprobe.d/blacklist.conf and rebuilding the initramfs
Physically disconnect Apple infrared receivers where the driver is not required for operations
Limit unprivileged access to system console and USB ports to reduce the ability to trigger disconnect races

bash

# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist hid-appleir" | sudo tee /etc/modprobe.d/blacklist-hid-appleir.conf
sudo update-initramfs -u
sudo modprobe -r hid-appleir