LiveActive security incident?Get immediate response
CVE Record

CVE-2021-46932: Input: appletouch - initialize work before device registration

In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue is a driver initialization bug in the appletouch input driver. Under the described condition, device close handling can touch uninitialized work state and trigger a kernel warning. The source bundle does not show data theft, privilege escalation, remote attack, or active exploitation.

Executive priority

Treat this as a targeted kernel hygiene item, not an emergency based on current evidence. Fold it into normal kernel update cycles unless your fleet uses the appletouch driver broadly or vendor guidance raises severity.

Technical view

The appletouch driver initialized dev->work after input_register_device(). Because input_dev->close() can call cancel_work_sync(&dev->work), syzbot observed __flush_work() warning when work->func was NULL. Kernel stable commits move work initialization before device registration.

Likely exposure

Exposure is most plausible on Linux systems using the appletouch input driver and affected kernel versions. Servers without this driver or relevant hardware are less likely exposed. The bundle provides no CPEs, distro advisories, CVSS, or exploitability details, so validation should use kernel version and configuration evidence.

Exploitation context

No active exploitation is stated. The KEV flag is false. The available sources describe a syzbot-triggered kernel warning and a corrective initialization-order patch, not a public exploit, weaponized chain, or confirmed real-world abuse.

Researcher notes

The evidence is narrow: Linux kernel appletouch workqueue initialization order, syzbot warning, and stable commits. The bundle lacks CVSS, CWE, CPEs, distro package mapping, and exploitability analysis. Avoid extending impact beyond the described warning without vendor evidence.

Mitigation direction

  • Review vendor kernel advisories for backported fixes covering CVE-2021-46932.
  • Update to a kernel containing the referenced stable appletouch fix.
  • Prioritize systems that load or ship the appletouch input driver.
  • If patching is delayed, assess whether the appletouch driver is needed.

Validation and detection

  • Inventory Linux kernel versions across endpoints and specialized hardware.
  • Check whether the appletouch driver is built, available, or loaded.
  • Compare deployed kernels against vendor fixed builds or referenced stable commits.
  • Review kernel logs for related appletouch or __flush_work warnings.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-46932 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298da, 5a6eb676d3bc4d7a6feab200a92437b62ad298daunaffected
LinuxLinux2.6.23, 0, 4.4.298, 4.9.296, 4.14.261, 4.19.224, 5.4.170, 5.10.90, 5.15.13, 5.16affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.