The bug is a use‑after‑free in the Linux HID appletb-kbd driver, occurring during the cleanup of an inactivity timer. The flaw allows the driver to reference deallocated memory while processing backlight or event callbacks. It is inferred that an attacker who can trigger these windows could cause a kernel panic or possibly execute code with kernel privileges, leading to system compromise.

All Linux kernel installations that include the HID appletb-kbd driver are potentially affected. The description does not list specific kernel versions, so any kernel that has not yet applied the commit removing the use‑after‑free is at risk. Users should verify whether their kernel branch contains the fix, or consult the vendor release notes for a patched kernel.

The CVSS score is not provided, but the use‑after‑free could lead to a kernel crash, which is a high severity outcome. The EPSS score of < 1% indicates a very low exploitation probability. It is inferred from the description that the flaw requires interaction with a HID device that triggers callback timing windows, suggesting the attack vector is likely local or via a malicious USB input device. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is documented; however, kernel memory corruption is a common escalation route, so the risk can be considered high to critical for systems that process Apple HID devices.