Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46213

In the Linux kernel, the following vulnerability has been resolved: HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to both the probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer reachable during driver tear-down via two distinct windows. Window A -- put_device() before timer_delete_sync():
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:629e9f0d1fe869e79274fc904e769d24d73ec9b5cd7ddc4de4defae6db7c1717
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-appletb-kbd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"59a79938ca5541fe55d675304116b7ea684afef0","status":"affected","version":"38224c472a038fa9ccd4085511dd9f3d6119dbf9","versionType":"git"},{"lessThan":"93d989e47bc316c793a69c6a332e053c90e29f02","status":"affected","version":"38224c472a038fa9ccd4085511dd9f3d6119dbf9","versionType":"git"},{"lessThan":"4db2af929279c799b5653a39eb0795c72baffca4","status":"affected","version":"38224c472a038fa9…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-appletb-kbd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.32","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-appletb-kbd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"59a79938ca5541fe55d675304116b7ea684afef0","status":"affected","version":"38224c472a038fa9ccd4085511dd9f3d6119dbf9","versionType":"git"},{"lessThan":"93d989e47bc316c793a69c6a332e053c90e29f02","status":"affected","version":"38224c472a038fa9ccd4085511dd9f3d6119dbf9","versionType":"git"},{"lessThan":"4db2af929279c799b5653a39eb0795c72baffca4","status":"affected","version":"38224c472a038fa9…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-appletb-kbd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.32","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/affected/1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/4db2af929279c799b5653a39eb0795c72baffca4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/59a79938ca5541fe55d675304116b7ea684afef0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/93d989e47bc316c793a69c6a332e053c90e29f02"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:313e88b7afe45d2eb7d4b8579eaa6bfe2a031616be183267dbed6871ebc904f4 · sha256:a9715d12ad26a4a5… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer