CVE-2026-46202

What it actually does

This flaw is a Linux kernel availability issue in the hid-appletb-kbd driver used for Apple Touch Bar keyboard backlight handling. The driver can call backlight_device_set_brightness(), which may sleep while taking a mutex, from atomic contexts such as timer, softirq, IRQ, URB completion, or input-event paths. Calling a sleeping function from atomic context can trigger kernel warnings and, depending on kernel configuration and runtime handling, may degrade stability or cause a local denial of service. The upstream fix moves the brightness dimming and restore operations to workqueues so the mutex-taking operation runs in process context where sleeping is permitted.

Why it matters to the business

Systems using affected Linux kernels with the Apple Touch Bar keyboard driver may experience instability, kernel warnings, or possible outages caused by local input or device activity. The practical exposure is narrower than a network-facing vulnerability because exploitation requires local access or interaction with affected hardware/driver paths, but affected endpoints can still suffer reliability incidents, user disruption, and support burden. The CVSS score is medium, EPSS is very low, it is not listed in CISA KEV, and no public exploit maturity is indicated, so remediation should be prioritized as part of normal kernel maintenance unless the affected driver is present on business-critical Linux endpoints.

How an attack unfolds

An attacker or local user with access to an affected system triggers the Apple Touch Bar keyboard input or inactivity paths while the hid-appletb-kbd driver is managing keyboard backlight dimming or restoration. The vulnerable paths include the inactivity timer callback and reset logic invoked from HID/input events. When the backlight is dimmed, turned off, or restored, the driver calls backlight_device_set_brightness() directly from an atomic context. That call attempts to acquire backlight_device->ops_lock via mutex_lock(), which is not allowed in atomic context. The kernel detects the invalid sleepable operation and emits a "BUG: sleeping function called from invalid context" warning; on systems configured to panic on such bugs or where repeated triggering destabilizes the kernel, this can result in denial of service.

How to fix it

Upgrade to a Linux kernel build that includes the upstream hid-appletb-kbd fix that converts the inactivity timer to delayed_work and schedules restore_brightness_work for brightness restoration. No exact fixed package versions were provided, so use the fixed kernel versions published by the operating system or distribution vendor for this CVE. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the hid-appletb-kbd driver on systems that do not require Apple Touch Bar keyboard functionality, limiting local shell access to trusted users, and avoiding panic-on-warn or panic-on-oops settings where operationally appropriate and consistent with security policy. Because this is a kernel flaw, rebooting into the patched kernel is required after installation.

How to confirm the fix worked

Confirm the running kernel version, not only the installed package version, after remediation. Verify that the vendor kernel changelog or source package includes the hid-appletb-kbd workqueue fix for the Apple Touch Bar keyboard backlight autodim logic. On source-based or custom kernels, inspect the driver implementation to confirm the inactivity logic uses delayed_work and restore brightness uses a work_struct rather than calling backlight_device_set_brightness() directly from timer or input/IRQ paths. Check whether the hid-appletb-kbd module is loaded on potentially affected systems. After patching and rebooting, exercise keyboard input and inactivity dim/restore behavior and confirm that kernel logs no longer show mutex-from-atomic or sleeping-function warnings associated with appletb_inactivity_timer, reset_inactivity_timer, or backlight_device_set_brightness.

Typical attack path

1. Obtain local access to a Linux system running an affected kernel with the hid-appletb-kbd driver active.
2. Confirm or rely on the presence of Apple Touch Bar keyboard/backlight functionality handled by the vulnerable driver.
3. Trigger user input or allow inactivity transitions that cause the driver to dim, turn off, or restore the keyboard backlight.
4. Cause the vulnerable path to call backlight_device_set_brightness() from timer, softirq, IRQ, URB completion, or input-event context.
5. Induce kernel warnings and potential system instability or denial of service, especially on systems configured to panic on kernel BUG/WARN conditions.

How to detect it

To determine whether this issue was already triggered, review kernel logs and persistent journal records for sleeping-in-atomic-context warnings involving hid-appletb-kbd, appletb_inactivity_timer, reset_inactivity_timer, backlight_device_set_brightness, mutex_lock, timer softirq, URB completion, or input-event paths. Relevant sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd-journald kernel facility logs, crash dump metadata, kdump/vmcore records, and endpoint telemetry that captures kernel oops/warn events. Look for repeated warnings around keyboard activity, inactivity dimming, resume events, USB HID events, or Touch Bar backlight transitions. Because exploitation does not require a distinctive payload and may look like normal local device activity, detection should focus on kernel warning artifacts and system crash timelines rather than network indicators. There are no known threat actors or campaigns reported for this CVE, and it is not currently listed in KEV.

• BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
• backlight_device_set_brightness
• appletb_inactivity_timer
• reset_inactivity_timer
• appletb_kbd_hid_event
• appletb_kbd_inp_event
• run_timer_softirq
• call_timer_fn
• __mutex_lock
• __might_resched
• hid-appletb-kbd
• appletb_inactivity_work
• restore_brightness_work
• backlight_device->ops_lock

What your security team should do

• Inventory Linux endpoints and servers for affected kernel versions and for the presence or loading of the hid-appletb-kbd driver.
• Prioritize remediation on Linux desktops, developer workstations, or specialized systems using Apple Touch Bar keyboard hardware.
• Apply the vendor-provided kernel update and reboot into the patched kernel; verify the running kernel version after reboot.
• If patching is delayed and the hardware feature is unnecessary, disable or blacklist the hid-appletb-kbd module as a temporary mitigation.
• Review kernel panic policy for affected fleets, because configurations that panic on WARN/OOPS may convert this bug into a more reliable denial-of-service condition.
• Monitor kernel logs for the specific mutex-from-atomic and appletb-kbd backtrace indicators listed below.
• Treat exploitation risk as lower than remotely exploitable kernel flaws due to local access and hardware/driver prerequisites, but include it in routine kernel patch cycles.