CVE-2026-64363

A flaw was found in the appleir Human Interface Device (HID) driver in the Linux kernel. A use-after-free (UAF) vulnerability can occur if a key is pressed shortly before an Apple infrared (IR) device is disconnected. This timing issue allows a pending timer to access freed memory, which may lead to system instability or a denial of service.

This vulnerability is rated as Moderate severity by Red Hat because exploitation requires local access and specific physical or emulated hardware interaction, restricting the maximum impact to a local denial of service. In typical enterprise server and cloud installations, Apple infrared receivers are rarely deployed, significantly minimizing attack opportunities. Exploitation requires triggering input activity concurrently with device disconnection to induce memory corruption and crash the operating system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.