{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-68822", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.048Z", "datePublished": "2026-01-13T15:29:24.703Z", "dateUpdated": "2026-08-05T12:11:48.046Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:48.046Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: alps - fix use-after-free bugs caused by dev3_register_work\n\nThe dev3_register_work delayed work item is initialized within\nalps_reconnect() and scheduled upon receipt of the first bare\nPS/2 packet from an external PS/2 device connected to the ALPS\ntouchpad. During device detachment, the original implementation\ncalls flush_workqueue() in psmouse_disconnect() to ensure\ncompletion of dev3_register_work. However, the flush_workqueue()\nin psmouse_disconnect() only blocks and waits for work items that\nwere already queued to the workqueue prior to its invocation. Any\nwork items submitted after flush_workqueue() is called are not\nincluded in the set of tasks that the flush operation awaits.\nThis means that after flush_workqueue() has finished executing,\nthe dev3_register_work could still be scheduled. Although the\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\nthe scheduling of dev3_register_work remains unaffected.\n\nThe race condition can occur as follows:\n\nCPU 0 (cleanup path) | CPU 1 (delayed work)\npsmouse_disconnect() |\n psmouse_set_state() |\n flush_workqueue() | alps_report_bare_ps2_packet()\n alps_disconnect() | psmouse_queue_work()\n kfree(priv); // FREE | alps_register_bare_ps2_mouse()\n | priv = container_of(work...); // USE\n | priv->dev3 // USE\n\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\nthat dev3_register_work is properly canceled and prevented from\nexecuting after the alps_data structure has been deallocated.\n\nThis bug is identified by static analysis." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The SERIO_8042 byte stream is locally reachable through the userio serio-emulation device, leading through serio_interrupt(), ps2_interrupt(), and alps_process_byte() to the vulnerable path. In a reasonable deployment granting an input-testing account access to /dev/userio, direct physical access is unnecessary.\nAC:L - The attacker can provoke reconnect failure and concurrently inject the first bare PS/2 packet during disconnect, controlling both sides of the race and allowing repeated attempts. No condition inherently outside the attacker's control is required.\nPR:L - The userio command path contains no capability check; a basic local account with device-file access can emulate a SERIO_8042 ALPS device, inject packets, and provoke teardown. Init-namespace root is not intrinsically required.\nUI:N - The attacker can drive device emulation, reconnect failure, packet delivery, and the resulting race without any victim action.\nS:U - The vulnerable worker and resulting corruption execute within the host kernel's existing security authority; ordinary kernel privilege escalation does not cross a separate security scope.\nC:H - The worker dereferences attacker-reclaimable alps_data, psmouse, and serio objects after free. Reclaiming the embedded pending work object can provide controlled kernel-pointer dereferences and ultimately arbitrary kernel-memory disclosure.\nI:H - The stale worker writes an input-device pointer and physical-path string into freed memory, while the embedded work_struct and its function pointer are themselves reclaimable. This supports heap corruption, arbitrary writes, and control-flow hijacking.\nA:H - Executing a delayed work item from freed storage can immediately cause invalid pointer dereferences, corrupted workqueue state, an oops, or a kernel panic, and the trigger can be retried." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/input/mouse/alps.c" ], "versions": [ { "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794", "lessThan": "ed8c61b89be0c45f029228b2913d5cf7b5cda1a7", "status": "affected", "versionType": "git" }, { "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794", "lessThan": "a9c115e017b2c633d25bdfe6709dda6fc36f08c2", "status": "affected", "versionType": "git" }, { "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794", "lessThan": "bf40644ef8c8a288742fa45580897ed0e0289474", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/input/mouse/alps.c" ], "versions": [ { "version": "4.0", "status": "affected" }, { "version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.64", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.18.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7" }, { "url": "https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2" }, { "url": "https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474" } ], "title": "Input: alps - fix use-after-free bugs caused by dev3_register_work", "x_generator": { "engine": "bippy-1.2.0" } } } }