一、漏洞信息
漏洞编号：CVE-2026-64363
漏洞归属组件：kernel
漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.12.33,6.18.18,6.4.0,6.6.0
CVSS评分：
BaseScore：7.8 High
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述：
In the Linux kernel, the following vulnerability has been resolved:HID: appleir: fix UAF on pending key_up_timer in remove()appleir_remove() runs hid_hw_stop() before timer_delete_sync().hid_hw_stop() synchronously unregisters the HID input device viahid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),which drops the last reference and frees the underlying input_dev whenno userspace handle holds it open.key_up_tick() reads appleir->input_dev and calls input_report_key() /input_sync() on it. The timer is armed from appleir_raw_event() witha HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If akey was pressed shortly before the device is disconnected, the timercan fire after hid_hw_stop() has freed input_dev but before theteardown drains it.A simple reorder is not sufficient. Putting the timer drain firststill leaves a window where a USB URB completion (raw_event) runningduring hid_hw_stop() can call mod_timer() and re-arm the timer, whichthen fires after hidinput_disconnect() has freed input_dev. The sameURB-completion window also lets raw_event() reach key_up(), key_down()and battery_flat() directly, all of which dereferenceappleir->input_dev.Introduce a removing flag on struct appleir, gated by the existingspinlock. appleir_remove() sets the flag under the lock and thenshuts down the timer with timer_shutdown_sync(), which both drains anyin-flight callback and permanently disables further mod_timer() calls.appleir_raw_event() and key_up_tick() bail out early if the flag isset, so no path can arm or run the timer, or dereferenceappleir->input_dev, after remove() has started tearing down.The keyrepeat and flatbattery branches of appleir_raw_event()previously called into the input layer without holding the spinlock;take it now so the flag check is well-defined. This incidentallycloses a pre-existing read-side race on appleir->current_key in thekeyrepeat branch.This bug is structurally a sibling of commit 4db2af929279 ( HID:appletb-kbd: fix UAF in inactivity-timer cleanup path ) and has beenpresent since the driver was introduced.
漏洞公开时间：2026-07-25 18:17:18
漏洞创建时间：2026-07-26 01:46:21
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2026-64363

漏洞分析指导链接：
https://atomgit.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
七彩瞬析开源风险感知平台
漏洞补丁信息：

二、漏洞分析结构反馈
影响性分析说明：
In the Linux kernel, the following vulnerability has been resolved:HID: appleir: fix UAF on pending key_up_timer in remove()appleir_remove() runs hid_hw_stop() before timer_delete_sync().hid_hw_stop() synchronously unregisters the HID input device viahid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),which drops the last reference and frees the underlying input_dev whenno userspace handle holds it open.key_up_tick() reads appleir->input_dev and calls input_report_key() /input_sync() on it. The timer is armed from appleir_raw_event() witha HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If akey was pressed shortly before the device is disconnected, the timercan fire after hid_hw_stop() has freed input_dev but before theteardown drains it.A simple reorder is not sufficient. Putting the timer drain firststill leaves a window where a USB URB completion (raw_event) runningduring hid_hw_stop() can call mod_timer() and re-arm the timer, whichthen fires after hidinput_disconnect() has freed input_dev. The sameURB-completion window also lets raw_event() reach key_up(), key_down()and battery_flat() directly, all of which dereferenceappleir->input_dev.Introduce a removing flag on struct appleir, gated by the existingspinlock. appleir_remove() sets the flag under the lock and thenshuts down the timer with timer_shutdown_sync(), which both drains anyin-flight callback and permanently disables further mod_timer() calls.appleir_raw_event() and key_up_tick() bail out early if the flag isset, so no path can arm or run the timer, or dereferenceappleir->input_dev, after remove() has started tearing down.The keyrepeat and flatbattery branches of appleir_raw_event()previously called into the input layer without holding the spinlock;take it now so the flag check is well-defined. This incidentallycloses a pre-existing read-side race on appleir->current_key in thekeyrepeat branch.This bug is structurally a sibling of commit 4db2af929279 ( HID:appletb-kbd: fix UAF in inactivity-timer cleanup path ) and has beenpresent since the driver was introduced.
openEuler评分：
7.8
Vector：CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响)：
1.master(6.18.40):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS-Next(6.6.0):不受影响
5.openEuler-24.03-LTS-SP1(6.6.0):受影响
6.openEuler-24.03-LTS-SP3(6.6.0):受影响
7.openEuler-24.03-LTS-SP4(6.6.0):受影响
8.openEuler-22.03-LTS-SP3(5.10.0):受影响
9.openEuler-24.03-LTS(6.6.0):受影响
10.openEuler-24.03-LTS-SP2(6.6.0):受影响

修复是否涉及abi变化(是/否)：
1.master(6.18.40):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP4(5.10.0):否
4.openEuler-24.03-LTS-Next(6.6.0):否
5.openEuler-24.03-LTS-SP1(6.6.0):否
6.openEuler-24.03-LTS-SP3(6.6.0):否
7.openEuler-24.03-LTS-SP4(6.6.0):否
8.openEuler-22.03-LTS-SP3(5.10.0):否
9.openEuler-24.03-LTS(6.6.0):否
10.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
1.master(6.18.40):不受影响-漏洞代码不能被攻击者触发
2.openEuler-20.03-LTS-SP4(4.19.90):正常修复
3.openEuler-22.03-LTS-SP4(5.10.0):正常修复
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-SP1(6.6.0):正常修复
6.openEuler-24.03-LTS-SP3(6.6.0):正常修复
7.openEuler-24.03-LTS-SP4(6.6.0):正常修复
8.openEuler-22.03-LTS-SP3(5.10.0):正常修复
9.openEuler-24.03-LTS(6.6.0):正常修复
10.openEuler-24.03-LTS-SP2(6.6.0):正常修复