PT-2026-64584 · Linux · Linux
CVE-2026-64363
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
HID: appleir: fix UAF on pending key up timer in remove()
appleir remove() runs hid hw stop() before timer delete sync().
hid hw stop() synchronously unregisters the HID input device via
hid disconnect() -> hidinput disconnect() -> input unregister device(),
which drops the last reference and frees the underlying input dev when
no userspace handle holds it open.
key up tick() reads appleir->input dev and calls input report key() /
input sync() on it. The timer is armed from appleir raw event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid hw stop() has freed input dev but before the
teardown drains it.
A simple reorder is not sufficient. Putting the timer drain first
still leaves a window where a USB URB completion (raw event) running
during hid hw stop() can call mod timer() and re-arm the timer, which
then fires after hidinput disconnect() has freed input dev. The same
URB-completion window also lets raw event() reach key up(), key down()
and battery flat() directly, all of which dereference
appleir->input dev.
Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock. appleir remove() sets the flag under the lock and then
shuts down the timer with timer shutdown sync(), which both drains any
in-flight callback and permanently disables further mod timer() calls.
appleir raw event() and key up tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input dev, after remove() has started tearing down.
The keyrepeat and flatbattery branches of appleir raw event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined. This incidentally
closes a pre-existing read-side race on appleir->current key in the
keyrepeat branch.
This bug is structurally a sibling of commit 4db2af929279 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux