CVE-2026-64363

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> HID: appleir: fix UAF on pending key_up_timer in remove()<br /> <br /> appleir_remove() runs hid_hw_stop() before timer_delete_sync().<br /> hid_hw_stop() synchronously unregisters the HID input device via<br /> hid_disconnect() -&gt; hidinput_disconnect() -&gt; input_unregister_device(),<br /> which drops the last reference and frees the underlying input_dev when<br /> no userspace handle holds it open.<br /> <br /> key_up_tick() reads appleir-&gt;input_dev and calls input_report_key() /<br /> input_sync() on it. The timer is armed from appleir_raw_event() with<br /> a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a<br /> key was pressed shortly before the device is disconnected, the timer<br /> can fire after hid_hw_stop() has freed input_dev but before the<br /> teardown drains it.<br /> <br /> A simple reorder is not sufficient. Putting the timer drain first<br /> still leaves a window where a USB URB completion (raw_event) running<br /> during hid_hw_stop() can call mod_timer() and re-arm the timer, which<br /> then fires after hidinput_disconnect() has freed input_dev. The same<br /> URB-completion window also lets raw_event() reach key_up(), key_down()<br /> and battery_flat() directly, all of which dereference<br /> appleir-&gt;input_dev.<br /> <br /> Introduce a &amp;#39;removing&amp;#39; flag on struct appleir, gated by the existing<br /> spinlock. appleir_remove() sets the flag under the lock and then<br /> shuts down the timer with timer_shutdown_sync(), which both drains any<br /> in-flight callback and permanently disables further mod_timer() calls.<br /> appleir_raw_event() and key_up_tick() bail out early if the flag is<br /> set, so no path can arm or run the timer, or dereference<br /> appleir-&gt;input_dev, after remove() has started tearing down.<br /> <br /> The keyrepeat and flatbattery branches of appleir_raw_event()<br /> previously called into the input layer without holding the spinlock;<br /> take it now so the flag check is well-defined. This incidentally<br /> closes a pre-existing read-side race on appleir-&gt;current_key in the<br /> keyrepeat branch.<br /> <br /> This bug is structurally a sibling of commit 4db2af929279 ("HID:<br /> appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been<br /> present since the driver was introduced.