CVE-2026-64363: HID: appleir: fix UAF on pending key_up_timer in remove()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

HID: appleir: fix UAF on pending key_up_timer in remove()

appleir_remove() runs hid_hw_stop() before timer_delete_sync().
hid_hw_stop() synchronously unregisters the HID input device via
hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),
which drops the last reference and frees the underlying input_dev when
no userspace handle holds it open.

key_up_tick() reads appleir->input_dev and calls input_report_key() /
input_sync() on it.  The timer is armed from appleir_raw_event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report.  If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid_hw_stop() has freed input_dev but before the
teardown drains it.

A simple reorder is not sufficient.  Putting the timer drain first
still leaves a window where a USB URB completion (raw_event) running
during hid_hw_stop() can call mod_timer() and re-arm the timer, which
then fires after hidinput_disconnect() has freed input_dev.  The same
URB-completion window also lets raw_event() reach key_up(), key_down()
and battery_flat() directly, all of which dereference
appleir->input_dev.

Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock.  appleir_remove() sets the flag under the lock and then
shuts down the timer with timer_shutdown_sync(), which both drains any
in-flight callback and permanently disables further mod_timer() calls.
appleir_raw_event() and key_up_tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input_dev, after remove() has started tearing down.

The keyrepeat and flatbattery branches of appleir_raw_event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined.  This incidentally
closes a pre-existing read-side race on appleir->current_key in the
keyrepeat branch.

This bug is structurally a sibling of commit 4db2af929279 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.

The Linux kernel CVE team has assigned CVE-2026-64363 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 5.10.261 with commit 89ef67359672bf4cd6921524e39f61648fe38c0f
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 5.15.212 with commit 3d30a0bb0e79621ae921b487835c56198adfafa3
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 6.1.178 with commit 37a52c61d4f78153c38ae1f7491dfcc8ac828dcf
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 6.6.145 with commit 05e3decc55d1deca9410e0eb36466651fcbe57a5
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 6.12.97 with commit 3755f6e25776b8b12ddf062f9b573f05090e4034
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 6.18.39 with commit b363d964ca829c1761c9f04188dfa28f90b0f2d4
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 7.1.4 with commit 6b0838e86da88b1d3bff86f19761ff25af73eaca
	Issue introduced in 3.10 with commit 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e and fixed in 7.2-rc3 with commit 75fe87e19d8aff81eb2c64d15d244ab8da4de945

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64363
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hid/hid-appleir.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f
	https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3
	https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf
	https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5
	https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034
	https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4
	https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca
	https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945