CVE-2025-68822
Description
In the Linux kernel, the following vulnerability has been resolved:
Input: alps - fix use-after-free bugs caused by dev3_register_work
The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected.
The race condition can occur as follows:
CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE
Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated.
This bug is identified by static analysis.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A use-after-free in the Linux kernel's ALPS touchpad driver due to a race between delayed work scheduling delayed work and device cleanup.
Vulnerability
In the Linux kernel's ALPS touchpad driver, a use-after-free bug exists in the handling of dev3_register_work, a delayed work item initialized during alps_reconnect() and scheduled upon receiving the first bare PS/2 packet from an external PS/2 device connected to the touchpad. The root cause is a race condition between the cleanup path and the delayed work execution. During device detachment, psmouse_disconnect() calls flush_workqueue() to wait for queued work items, but this only blocks for work already queued before the flush call. Work items submitted after flush_workqueue() returns are not awaited, so dev3_register_work can still be scheduled after the flush completes. Although the psmouse state is set to `PSMOUSE_CMD_MODE, this does not prevent scheduling of the delayed work.
Exploitation
An attacker would need physical access to the system to connect an external PS/2 device to the ALPS touchpad port, triggering the bare PS/2 packet that schedules dev3_register_work. The race occurs when the device is triggered during device disconnection (e.g., when the touchpad is removed or the driver is unbound). No authentication is required, but the attacker must be able to cause the device to be disconnected while the delayed work is pending or being scheduled.
Impact
If the race is successfully exploited, the delayed work executes after alps_disconnect() has freed the alps_data structure (priv). The work function then dereferences the freed memory, leading to a use-after-free. This can result in memory corruption, system crash, or potentially arbitrary code execution in kernel context, depending on the state of the freed memory.
Mitigation
The fix adds disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the `alps_data structure is deallocated. The patch has been applied to the Linux kernel stable tree [1]. Users should update to a kernel version containing this commit to mitigate the vulnerability.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.