The Linux kernel appleir HID driver contained a use-after-free vulnerability (CVE-2026-64363) due to improper ordering in device removal. Specifically, appleir_remove() called hid_hw_stop() before timer_delete_sync(), allowing a timer callback (key_up_tick) to access the freed input_dev pointer after hid_hw_stop() freed it. The timer is re-armed on key events, creating a race condition where the timer fires after device removal. The fix adds a 'removing' flag protected by a spinlock to prevent timer re-arming and input device access during removal, ensuring the timer is fully drained and disabled before device teardown completes. This also closes a pre-existing race on appleir->current_key.

This vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or undefined behavior. The description does not specify exploitation in the wild or direct privilege escalation, but use-after-free bugs in kernel input drivers can be security-critical if exploited. No known exploits are reported.

A fix has been implemented in the Linux kernel appleir driver that properly synchronizes timer shutdown and prevents use-after-free by introducing a removal flag and locking. Users should update to a Linux kernel version that includes this patch. Since this is a kernel vulnerability, applying the official kernel update or patch is the recommended mitigation. Patch status is not explicitly stated here; check the vendor or kernel mailing list advisories for the exact fixed kernel version.