The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Commit 38224c472a03 (HID: appletb-kbd: fix     slab use-after-free bug in appletb_kbd_probe) added timer_delete_sync(&kbd->inactivity_timer) to both the     probe close_hw error path and appletb_kbd_remove(), but the way it was wired in left the inactivity timer     reachable during driver tear-down via two distinct windows. Window A -- put_device() before     timer_delete_sync(): put_device(&kbd->backlight_dev->dev); timer_delete_sync(&kbd->inactivity_timer); The     inactivity_timer softirq reads kbd->backlight_dev and calls backlight_device_set_brightness() ->     mutex_lock(&ops_lock). If a concurrent hid_appletb_bl unbind drops the last devm reference between these     two calls, the backlight_device is freed and the mutex_lock() touches freed memory. Window B -- backlight     cleanup before hid_hw_stop(): if (kbd->backlight_dev) { timer_delete_sync(...); put_device(...); }     hid_hw_close(hdev); hid_hw_stop(hdev); Even after Window A is closed, hid_hw_close()/hid_hw_stop() still     run afterwards, so a late .event callback from the HID core (USB URB completion on real Apple hardware)     can arrive after timer_delete_sync() drained the softirq but before put_device() drops the reference. That     callback reaches reset_inactivity_timer(), which calls mod_timer() and re-arms the timer. The freshly re-     armed timer can then fire on the about-to-be-freed backlight_device. Both windows produce the same KASAN     slab-use-after-free: BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0 Read of size 8 at addr     ffff88803ee9a108 by task swapper/0/0 Call Trace: <IRQ> __mutex_lock backlight_device_set_brightness     appletb_inactivity_timer call_timer_fn run_timer_softirq handle_softirqs Allocated by task N:
    devm_backlight_device_register appletb_bl_probe Freed by task M: (concurrent hid_appletb_bl unbind path)     Close both windows at once by reworking the tear-down in appletb_kbd_remove() and in the probe close_hw     error path so that 1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup, guaranteeing no     further .event callback can fire and re-arm the timer, and 2) inside the if (kbd->backlight_dev) block,     timer_delete_sync() runs before put_device(), so the softirq is drained before the final reference is     dropped. (CVE-2026-46213)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-46213

high Nessus Plugin ID 318461

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Jun 23, 2026, 12:45 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202606231245
Version 1.3 Jun 23, 2026, 12:13 AM CVSS metrics ("CVSSv2 score" set to 6.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606230013
Version 1.2 Jun 11, 2026, 6:45 PM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") Plugin Feed: 202606111845
Version 1.1 Jun 4, 2026, 6:01 AM New Plugin Feed: 202606040601