Just did a cursory read of the commits related to security for this release, and my assumpion based solely on the changes, is that it’s not a remote-access vulnerability, but a supply-chain-esque vulnerability where a video you downloaded from a questionable source might trigger code embedded in the metadata to be run by jellyfin.

Do you have multiple NIC? I sporadically run into issues where traffic will try to route itself via a secondary network which has limited external access and it is resolved in a similar manner, by bringing down all networks, then re-starting them in a specific order.

Realistically I should probably define some static routes, but it works automatically 99% of the time so I never bother.

If this sounds like a possible cause, check your routes while in failed, and functional states, and set static routes as needed to resolve.

That answers my question. If the USB dongle never disconnects from the machine, then I wouldn’t expect anything to show in dmesg, as the ‘sleep mode’ is likely occurring downstream of the USB dongle.

Are there any config utilities that came with it? Failing that, maybe wireshark the dongle and see if there is any sort of sleep/wake signal being passed back through to the host machine?

To clarify, you have a dongle paired with this keyboard permanently attached to the machine?