Junglewise Threat Intelligence

CVE-2026-46202: Linux Kernel invalid context bug in Apple Touch Bar driver

CVE-2026-46202 · Severity: info · CVSS 4.4 · Published 2026-05-28

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A software bug has been identified in the Linux kernel's support for certain Apple keyboard Touch Bars. The issue occurs when the system attempts to automatically dim the Touch Bar backlight, which can cause the operating system to crash or behave unexpectedly due to an internal locking conflict. This primarily affects system stability and availability for users of specific hardware.

Technical details

A 'sleeping function called from invalid context' bug exists in the hid-appletb-kbd driver. The autodim code calls backlight_device_set_brightness(), which attempts to acquire a mutex (ops_lock). This occurs within atomic contexts: the appletb_inactivity_timer() (softirq context) and reset_inactivity_timer() (IRQ/softirq context during USB URB completion). Because mutexes can sleep and cannot be acquired in atomic contexts, this triggers a kernel BUG. The fix involves migrating these operations to a workqueue (process context) using struct delayed_work and struct work_struct. Patches have been merged into the stable kernel tree.

Affected products

  • Linux Linux Kernel 93a0fc489481 to 1654e53349d4e657b331de354313461f401f5063

Timeline

  • 2026-04-20: other: Patch authored
  • 2026-05-12: patched: Patch committed to mainline kernel
  • 2026-05-28: advisory: CVE published by NVD

References