GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68822 (GCVE-0-2025-68822)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-08-05 12:11
VLAI
Title
Input: alps - fix use-after-free bugs caused by dev3_register_work
Summary
In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 , < ed8c61b89be0c45f029228b2913d5cf7b5cda1a7 (git)
Affected: 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 , < a9c115e017b2c633d25bdfe6709dda6fc36f08c2 (git)
Affected: 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 , < bf40644ef8c8a288742fa45580897ed0e0289474 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.0
Unaffected: 0 , < 4.0 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/alps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed8c61b89be0c45f029228b2913d5cf7b5cda1a7",
              "status": "affected",
              "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794",
              "versionType": "git"
            },
            {
              "lessThan": "a9c115e017b2c633d25bdfe6709dda6fc36f08c2",
              "status": "affected",
              "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794",
              "versionType": "git"
            },
            {
              "lessThan": "bf40644ef8c8a288742fa45580897ed0e0289474",
              "status": "affected",
              "version": "04aae283ba6a8cd4851d937bf9c6d6ef0361d794",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/alps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: alps - fix use-after-free bugs caused by dev3_register_work\n\nThe dev3_register_work delayed work item is initialized within\nalps_reconnect() and scheduled upon receipt of the first bare\nPS/2 packet from an external PS/2 device connected to the ALPS\ntouchpad. During device detachment, the original implementation\ncalls flush_workqueue() in psmouse_disconnect() to ensure\ncompletion of dev3_register_work. However, the flush_workqueue()\nin psmouse_disconnect() only blocks and waits for work items that\nwere already queued to the workqueue prior to its invocation. Any\nwork items submitted after flush_workqueue() is called are not\nincluded in the set of tasks that the flush operation awaits.\nThis means that after flush_workqueue() has finished executing,\nthe dev3_register_work could still be scheduled. Although the\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\nthe scheduling of dev3_register_work remains unaffected.\n\nThe race condition can occur as follows:\n\nCPU 0 (cleanup path)     | CPU 1 (delayed work)\npsmouse_disconnect()     |\n  psmouse_set_state()    |\n  flush_workqueue()      | alps_report_bare_ps2_packet()\n  alps_disconnect()      |   psmouse_queue_work()\n    kfree(priv); // FREE | alps_register_bare_ps2_mouse()\n                         |   priv = container_of(work...); // USE\n                         |   priv-\u003edev3 // USE\n\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\nthat dev3_register_work is properly canceled and prevented from\nexecuting after the alps_data structure has been deallocated.\n\nThis bug is identified by static analysis."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The SERIO_8042 byte stream is locally reachable through the userio serio-emulation device, leading through serio_interrupt(), ps2_interrupt(), and alps_process_byte() to the vulnerable path. In a reasonable deployment granting an input-testing account access to /dev/userio, direct physical access is unnecessary.\nAC:L - The attacker can provoke reconnect failure and concurrently inject the first bare PS/2 packet during disconnect, controlling both sides of the race and allowing repeated attempts. No condition inherently outside the attacker\u0027s control is required.\nPR:L - The userio command path contains no capability check; a basic local account with device-file access can emulate a SERIO_8042 ALPS device, inject packets, and provoke teardown. Init-namespace root is not intrinsically required.\nUI:N - The attacker can drive device emulation, reconnect failure, packet delivery, and the resulting race without any victim action.\nS:U - The vulnerable worker and resulting corruption execute within the host kernel\u0027s existing security authority; ordinary kernel privilege escalation does not cross a separate security scope.\nC:H - The worker dereferences attacker-reclaimable alps_data, psmouse, and serio objects after free. Reclaiming the embedded pending work object can provide controlled kernel-pointer dereferences and ultimately arbitrary kernel-memory disclosure.\nI:H - The stale worker writes an input-device pointer and physical-path string into freed memory, while the embedded work_struct and its function pointer are themselves reclaimable. This supports heap corruption, arbitrary writes, and control-flow hijacking.\nA:H - Executing a delayed work item from freed storage can immediately cause invalid pointer dereferences, corrupted workqueue state, an oops, or a kernel panic, and the trigger can be retried."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:48.046Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474"
        }
      ],
      "title": "Input: alps - fix use-after-free bugs caused by dev3_register_work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68822",
    "datePublished": "2026-01-13T15:29:24.703Z",
    "dateReserved": "2025-12-24T10:30:51.048Z",
    "dateUpdated": "2026-08-05T12:11:48.046Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68822",
      "date": "2026-09-17",
      "epss": "0.00145",
      "percentile": "0.04144"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:57:14.000Z",
      "cve": "CVE-2025-68822",
      "id": "msrc_CVE-2025-68822",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:known_affected": "11",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Input: alps - fix use-after-free bugs caused by dev3_register_work",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-68822.json",
      "version": "12"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68822\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:04.550\",\"lastModified\":\"2026-07-30T06:24:47.683\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nInput: alps - fix use-after-free bugs caused by dev3_register_work\\n\\nThe dev3_register_work delayed work item is initialized within\\nalps_reconnect() and scheduled upon receipt of the first bare\\nPS/2 packet from an external PS/2 device connected to the ALPS\\ntouchpad. During device detachment, the original implementation\\ncalls flush_workqueue() in psmouse_disconnect() to ensure\\ncompletion of dev3_register_work. However, the flush_workqueue()\\nin psmouse_disconnect() only blocks and waits for work items that\\nwere already queued to the workqueue prior to its invocation. Any\\nwork items submitted after flush_workqueue() is called are not\\nincluded in the set of tasks that the flush operation awaits.\\nThis means that after flush_workqueue() has finished executing,\\nthe dev3_register_work could still be scheduled. Although the\\npsmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),\\nthe scheduling of dev3_register_work remains unaffected.\\n\\nThe race condition can occur as follows:\\n\\nCPU 0 (cleanup path)     | CPU 1 (delayed work)\\npsmouse_disconnect()     |\\n  psmouse_set_state()    |\\n  flush_workqueue()      | alps_report_bare_ps2_packet()\\n  alps_disconnect()      |   psmouse_queue_work()\\n    kfree(priv); // FREE | alps_register_bare_ps2_mouse()\\n                         |   priv = container_of(work...); // USE\\n                         |   priv-\u003edev3 // USE\\n\\nAdd disable_delayed_work_sync() in alps_disconnect() to ensure\\nthat dev3_register_work is properly canceled and prevented from\\nexecuting after the alps_data structure has been deallocated.\\n\\nThis bug is identified by static analysis.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nEntrada: alps - corrige errores de uso despu\u00e9s de liberaci\u00f3n causados por dev3_register_work\\n\\nEl elemento de trabajo retrasado dev3_register_work se inicializa dentro de alps_reconnect() y se programa al recibir el primer paquete PS/2 \u0027bare\u0027 de un dispositivo PS/2 externo conectado al touchpad ALPS. Durante la desconexi\u00f3n del dispositivo, la implementaci\u00f3n original llama a flush_workqueue() en psmouse_disconnect() para asegurar la finalizaci\u00f3n de dev3_register_work. Sin embargo, la flush_workqueue() en psmouse_disconnect() solo bloquea y espera por elementos de trabajo que ya estaban en cola en la workqueue antes de su invocaci\u00f3n. Cualquier elemento de trabajo enviado despu\u00e9s de que se llama a flush_workqueue() no se incluye en el conjunto de tareas que la operaci\u00f3n de \u0027flush\u0027 espera. Esto significa que despu\u00e9s de que flush_workqueue() ha terminado de ejecutarse, el dev3_register_work a\u00fan podr\u00eda programarse. Aunque el estado de psmouse se establece en PSMOUSE_CMD_MODE en psmouse_disconnect(), la programaci\u00f3n de dev3_register_work permanece inalterada.\\n\\nLa condici\u00f3n de carrera puede ocurrir de la siguiente manera:\\n\\nCPU 0 (ruta de limpieza) | CPU 1 (trabajo retrasado)\\npsmouse_disconnect() |\\n  psmouse_set_state() |\\n  flush_workqueue() | alps_report_bare_ps2_packet()\\n  alps_disconnect() |   psmouse_queue_work()\\n    kfree(priv); // LIBERAR | alps_register_bare_ps2_mouse()\\n                         |   priv = container_of(work...); // USAR\\n                         |   priv-\u0026gt;dev3 // USAR\\n\\nA\u00f1adir disable_delayed_work_sync() en alps_disconnect() para asegurar que dev3_register_work se cancele correctamente y se impida su ejecuci\u00f3n despu\u00e9s de que la estructura alps_data haya sido desasignada.\\n\\nEste error es identificado por an\u00e1lisis est\u00e1tico.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/input/mouse/alps.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04aae283ba6a8cd4851d937bf9c6d6ef0361d794\",\"lessThan\":\"ed8c61b89be0c45f029228b2913d5cf7b5cda1a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04aae283ba6a8cd4851d937bf9c6d6ef0361d794\",\"lessThan\":\"a9c115e017b2c633d25bdfe6709dda6fc36f08c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04aae283ba6a8cd4851d937bf9c6d6ef0361d794\",\"lessThan\":\"bf40644ef8c8a288742fa45580897ed0e0289474\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/input/mouse/alps.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-21T20:47:04+00:00",
      "cve": "CVE-2025-68822",
      "id": "CVE-2025-68822",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Input: alps - fix use-after-free bugs caused by dev3_register_work",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68822.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.