In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key_up_timer in remove() appleir_remove() runs… (CVE-2026-64363)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
AI-suggested
A fix is available and has been applied to the Linux kernel appleir HID driver. Users should update to a kernel version that includes this patch. No additional mitigation is required once the patch is applied.
Description
A use-after-free (UAF) vulnerability in the Linux kernel's appleir HID driver was fixed. The issue occurs because the timer callback can access freed input device memory after device removal, leading to potential memory corruption. The fix introduces a removal flag and synchronizes timer shutdown to prevent use-after-free conditions.
Impact
This vulnerability allows local attackers with limited privileges (local vector, low complexity, low privileges required) to cause use-after-free conditions, potentially leading to memory corruption with high impact on confidentiality, integrity, and availability of the system. Exploitation could result in system crashes or privilege escalation.
Summary
The Linux kernel appleir HID driver had a use-after-free vulnerability (CVE-2026-64363) caused by the key_up_timer firing after the input device was freed during device removal. The removal sequence called hid_hw_stop() before timer_delete_sync(), allowing a timer callback to dereference freed memory. The fix adds a 'removing' flag protected by a spinlock to prevent timer re-arming and callbacks after removal begins, and synchronizes timer shutdown to drain in-flight callbacks. This prevents use-after-free on appleir->input_dev and closes a related race condition on appleir->current_key.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-64363 (opens in a new tab)
- git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5 (opens in a new tab)
- git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034 (opens in a new tab)
- git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf (opens in a new tab)
- git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3 (opens in a new tab)
- git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca (opens in a new tab)
- git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945 (opens in a new tab)
- git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f (opens in a new tab)
- git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4 (opens in a new tab)