CVE-2026-46213

What it actually does

This is a local Linux kernel use-after-free in the HID Apple Touch Bar keyboard/backlight driver teardown path. During device removal, probe error handling, or related unbind activity, the driver can leave an inactivity timer or late HID event callback able to reference a backlight device after its final reference has been dropped. The freed object is then accessed through the timer callback path, including backlight_device_set_brightness() and mutex locking, producing a kernel slab use-after-free. In practical terms, a local attacker who can influence the relevant HID device lifecycle may be able to trigger kernel memory corruption, potentially causing a crash or, with a reliable exploit, local privilege escalation with kernel-level code execution.

Why it matters to the business

Affected Linux systems using the vulnerable Apple Touch Bar keyboard/backlight HID driver may be exposed to local privilege escalation or denial-of-service risk. The most likely operational impact is system instability, kernel panic, or crash during device unbind/removal or driver teardown; the higher-impact scenario is an attacker with local access gaining elevated privileges. The issue is not known to be in CISA KEV, is not reported as used in ransomware campaigns, has very low EPSS, and has no stated public exploit maturity, so broad internet-scale exploitation is unlikely; however, endpoints or workstations with matching Apple hardware and vulnerable kernels should still be patched through normal kernel update processes.

How an attack unfolds

An attacker first needs local access to a vulnerable Linux system where the affected Apple Touch Bar keyboard/backlight HID driver is loaded and the relevant hardware or device path is present. The attacker then attempts to manipulate the driver lifecycle, such as triggering HID events while causing device removal, driver unbind, probe failure cleanup, or backlight device teardown. Because the vulnerable teardown order allowed the inactivity timer or a late HID event callback to remain reachable, the timer could be re-armed or fired after the backlight device was freed. When the stale timer callback runs, it dereferences the freed backlight device and reaches kernel synchronization code such as __mutex_lock(), causing a slab use-after-free. A simple exploit would crash the system; a more advanced exploit would attempt to shape kernel heap state around the freed object to convert the use-after-free into controlled kernel memory corruption and privilege escalation.

How to fix it

Update the Linux kernel to a version containing the upstream fix for the appletb-kbd inactivity-timer cleanup use-after-free. Because no exact fixed package versions were provided, use the latest stable kernel or the latest vendor/distribution security kernel that includes the fix for this issue. The corrected behavior closes both teardown race windows by stopping HID hardware before backlight cleanup and by deleting/synchronizing the inactivity timer before dropping the final backlight device reference. If immediate patching is not possible, reduce exposure by disabling or blacklisting the affected Apple Touch Bar keyboard/backlight HID driver on systems that do not require it, limiting local shell access, preventing untrusted users from manipulating device binding/unbinding interfaces, and restricting access to sysfs driver unbind controls where feasible.

How to confirm the fix worked

Confirm the system is running a kernel build that includes the upstream or vendor backport fix for the appletb-kbd teardown ordering issue. Validate by checking distribution security advisories and kernel changelogs for references to the appletb-kbd inactivity timer cleanup fix, the HID appletb-kbd use-after-free fix, or the commit message 'HID: appletb-kbd: fix UAF in inactivity-timer cleanup path'. On potentially affected systems, verify whether the relevant driver is present or loaded by checking loaded modules, kernel configuration, and HID/backlight devices under sysfs. After patching, confirm the system is booted into the updated kernel, not merely that the package is installed. For engineering validation, KASAN-enabled test kernels should no longer produce slab-use-after-free reports in appletb_inactivity_timer, backlight_device_set_brightness, or __mutex_lock during repeated device bind/unbind and HID event stress testing.

Typical attack path

1. Gain local code execution or an interactive local session on a vulnerable Linux system.
2. Confirm the affected HID Apple Touch Bar keyboard/backlight driver is present or loaded.
3. Trigger driver teardown, device unbind, removal, or probe cleanup while HID events or timer activity can still occur.
4. Race the inactivity timer or late HID event callback against backlight device cleanup.
5. Cause the timer callback to access the freed backlight device object.
6. Use the resulting kernel use-after-free to crash the system or attempt local privilege escalation.

How to detect it

Retrospective exploitation detection is difficult because successful kernel memory corruption may leave only crash artifacts or generic kernel logs. Review kernel ring buffer logs, persistent journal entries, crash dumps, pstore records, and kernel panic reports for use-after-free signatures involving the Apple Touch Bar keyboard/backlight HID driver. Useful sources include /var/log/kern.log, /var/log/messages, systemd-journald kernel logs, dmesg output, kdump/vmcore data, pstore/ramoops records, and endpoint telemetry that captures kernel oops or panic events. Look for KASAN reports showing slab-use-after-free in __mutex_lock, backlight_device_set_brightness, appletb_inactivity_timer, call_timer_fn, or run_timer_softirq. Also review local audit logs and shell history, where available, for suspicious writes to sysfs driver unbind/bind paths associated with HID, Apple Touch Bar, or backlight devices shortly before a crash. A single crash is not proof of exploitation, but repeated appletb-kbd/backlight UAF traces, especially near manual device unbind activity by non-administrative users, should be investigated as potentially malicious triggering.

• BUG: KASAN: slab-use-after-free in __mutex_lock
• slab-use-after-free in __mutex_lock
• backlight_device_set_brightness
• appletb_inactivity_timer
• call_timer_fn
• run_timer_softirq
• handle_softirqs
• devm_backlight_device_register
• appletb_bl_probe
• appletb_kbd_remove
• reset_inactivity_timer
• hid_appletb_bl
• appletb-kbd
• HID: appletb-kbd
• /sys/bus/hid/drivers/
• /sys/bus/hid/drivers/*/unbind
• /sys/bus/hid/drivers/*/bind
• /sys/class/backlight/
• timer_delete_sync
• hid_hw_stop
• hid_hw_close

What your security team should do

• Prioritize kernel updates for Linux endpoints or workstations using Apple Touch Bar keyboard/backlight hardware or the affected HID driver.
• Treat this primarily as a local privilege escalation and stability issue; prioritize systems with shared-user access, developer workstations, kiosks, lab machines, or environments where untrusted local code can run.
• Verify that patched systems have rebooted into the fixed kernel version.
• If patching is delayed, consider disabling or blacklisting the affected appletb-kbd/backlight functionality where operationally acceptable.
• Restrict local user access to device-management interfaces, including sysfs driver bind/unbind paths, to reduce the ability to trigger the race.
• Monitor kernel logs for KASAN, slab-use-after-free, backlight, HID, or appletb-related crash signatures.
• Because the issue is not KEV-listed, not ransomware-associated, and has very low EPSS, handle through expedited routine patching unless affected hardware is widely deployed or local multi-user exposure is high.