Executive brief
A vulnerability was identified in the Linux kernel's Apple Touch Bar keyboard driver. This issue could allow a local user to cause a system crash (denial of service) during specific hardware removal or driver unbinding events. The flaw is caused by improper management of internal timers, which can lead to the system attempting to access memory that has already been released.
Technical details
A use-after-free (UAF) vulnerability exists in the HID appletb-kbd driver due to an improper cleanup sequence in the inactivity-timer path. Specifically, two race conditions (Window A and Window B) allow the inactivity timer to remain active or be re-armed after the backlight device has been freed. In Window A, the driver calls put_device() before timer_delete_sync(), allowing a softirq to access the freed backlight_dev. In Window B, HID events can re-arm the timer after it has been deleted but before the hardware is fully stopped. An attacker with local access could potentially trigger these conditions during driver unbinding to cause a kernel panic. The fix reorders the teardown sequence to ensure hardware is stopped and timers are synchronized before device references are dropped.
Affected products
- Linux Linux kernel versions prior to 4db2af929279c799b5653a39eb0795c72baffca4
Timeline
- 2026-04-20: patched: Initial fix authored by Sangyun Kim
- 2026-05-28: advisory: CVE-2026-46213 published by NVD