CVE-2026-46202

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46202", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.104Z", "datePublished": "2026-05-28T09:40:18.687Z", "dateUpdated": "2026-06-14T18:02:25.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T18:02:25.494Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: run inactivity autodim from workqueues\n\nThe autodim code in hid-appletb-kbd takes backlight_device->ops_lock\nvia backlight_device_set_brightness() -> mutex_lock() from two\ndifferent atomic contexts:\n\n * appletb_inactivity_timer() is a struct timer_list callback, so it\n runs in softirq context. Every expiry triggers\n\n BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591\n Call Trace:\n <IRQ>\n __might_resched\n __mutex_lock\n backlight_device_set_brightness\n appletb_inactivity_timer\n call_timer_fn\n run_timer_softirq\n\n * reset_inactivity_timer() is called from appletb_kbd_hid_event() and\n appletb_kbd_inp_event(). On real USB hardware these run in\n softirq/IRQ context (URB completion and input-event dispatch).\n When the Touch Bar has already been dimmed or turned off, the\n reset path calls backlight_device_set_brightness() directly to\n restore brightness, producing the same warning.\n\nBoth call sites hit the same mutex_lock()-from-atomic bug. Fix them\ntogether by moving the blocking work onto the system workqueue:\n\n * Convert the inactivity timer from struct timer_list to\n struct delayed_work; the callback (appletb_inactivity_work) now\n runs in process context where mutex_lock() is legal.\n * Add a dedicated struct work_struct restore_brightness_work and have\n reset_inactivity_timer() schedule it instead of calling\n backlight_device_set_brightness() directly.\n\nCancel both works synchronously during driver tear-down alongside the\nexisting backlight reference drop.\n\nThe semantics are unchanged (same delays, same state transitions on\ndim, turn-off and user activity); only the execution context of the\nsleeping call changes. The timer field and callback are renamed to\nmatch their new type; reset_inactivity_timer() keeps its name because\nit is invoked from input event paths that read naturally as \"reset\nthe inactivity timer\"."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-appletb-kbd.c"], "versions": [{"version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "lessThan": "5c0830323689ef15224f0025276176988861b3b0", "status": "affected", "versionType": "git"}, {"version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "lessThan": "2473a334c292af257ef68e33bc7760f4a8251812", "status": "affected", "versionType": "git"}, {"version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "lessThan": "1654e53349d4e657b331de354313461f401f5063", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hid/hid-appletb-kbd.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.32", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.9", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.32"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5c0830323689ef15224f0025276176988861b3b0"}, {"url": "https://git.kernel.org/stable/c/2473a334c292af257ef68e33bc7760f4a8251812"}, {"url": "https://git.kernel.org/stable/c/1654e53349d4e657b331de354313461f401f5063"}], "title": "HID: appletb-kbd: run inactivity autodim from workqueues", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hid/hid-appletb-kbd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5c0830323689ef15224f0025276176988861b3b0", "status": "affected", "version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "versionType": "git"}, {"lessThan": "2473a334c292af257ef68e33bc7760f4a8251812", "status": "affected", "version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "versionType": "git"}, {"lessThan": "1654e53349d4e657b331de354313461f401f5063", "status": "affected", "version": "93a0fc48948107e0cc34e1de22c3cb363a8f2783", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hid/hid-appletb-kbd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.32", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "958C317D-76E8-46C1-B453-1D963E9DE1B1", "versionEndExcluding": "6.18.32", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "33ACA10B-B260-46EA-BD50-70EBE5097672", "versionEndExcluding": "7.0.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appletb-kbd: run inactivity autodim from workqueues\n\nThe autodim code in hid-appletb-kbd takes backlight_device->ops_lock\nvia backlight_device_set_brightness() -> mutex_lock() from two\ndifferent atomic contexts:\n\n * appletb_inactivity_timer() is a struct timer_list callback, so it\n runs in softirq context. Every expiry triggers\n\n BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591\n Call Trace:\n <IRQ>\n __might_resched\n __mutex_lock\n backlight_device_set_brightness\n appletb_inactivity_timer\n call_timer_fn\n run_timer_softirq\n\n * reset_inactivity_timer() is called from appletb_kbd_hid_event() and\n appletb_kbd_inp_event(). On real USB hardware these run in\n softirq/IRQ context (URB completion and input-event dispatch).\n When the Touch Bar has already been dimmed or turned off, the\n reset path calls backlight_device_set_brightness() directly to\n restore brightness, producing the same warning.\n\nBoth call sites hit the same mutex_lock()-from-atomic bug. Fix them\ntogether by moving the blocking work onto the system workqueue:\n\n * Convert the inactivity timer from struct timer_list to\n struct delayed_work; the callback (appletb_inactivity_work) now\n runs in process context where mutex_lock() is legal.\n * Add a dedicated struct work_struct restore_brightness_work and have\n reset_inactivity_timer() schedule it instead of calling\n backlight_device_set_brightness() directly.\n\nCancel both works synchronously during driver tear-down alongside the\nexisting backlight reference drop.\n\nThe semantics are unchanged (same delays, same state transitions on\ndim, turn-off and user activity); only the execution context of the\nsleeping call changes. The timer field and callback are renamed to\nmatch their new type; reset_inactivity_timer() keeps its name because\nit is invoked from input event paths that read naturally as \"reset\nthe inactivity timer\"."}], "id": "CVE-2026-46202", "lastModified": "2026-06-17T10:53:16.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-28T10:16:35.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1654e53349d4e657b331de354313461f401f5063"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2473a334c292af257ef68e33bc7760f4a8251812"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5c0830323689ef15224f0025276176988861b3b0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: HID: appletb-kbd: run inactivity autodim from workqueues", "id": "2482597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482597"}, "csaw": false, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel's Apple Touch Bar keyboard driver. This vulnerability allows the system to become unstable or crash (kernel panic) when the driver's inactivity autodim feature attempts to acquire a lock from an inappropriate execution context. This can be triggered by a local user interacting with the Touch Bar, leading to a Denial of Service (DoS)."], "name": "CVE-2026-46202", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46202\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46202\nhttps://lore.kernel.org/linux-cve-announce/2026052832-CVE-2026-46202-e976@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93a0fc48948107e0cc34e1de22c3cb363a8f2783,5c0830323689ef15224f0025276176988861b3b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93a0fc48948107e0cc34e1de22c3cb363a8f2783,2473a334c292af257ef68e33bc7760f4a8251812)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93a0fc48948107e0cc34e1de22c3cb363a8f2783,1654e53349d4e657b331de354313461f401f5063)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.32,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.9,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T13:15:22.416625+00:00", "updated": "2026-06-10T19:00:07.786961+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}