Skip to main content

Linux Kernel CVE-2025-68822

HIGH
Use After Free (CWE-416)
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Use After Free Memory Corruption
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local session on ALPS-equipped host
  2. Delivery
    Attach external PS/2 device to schedule dev3_register_work
  3. Exploit
    Trigger touchpad detachment to race disconnect
  4. Execution
    Delayed work runs after alps_data freed
  5. Persist
    Corrupt freed kernel heap (use-after-free)
  6. Impact
    Escalate privileges or crash kernel

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local access to a system with ALPS touchpad hardware whose kernel loads the ALPS psmouse driver, plus an external PS/2 device connected through the touchpad so that a bare PS/2 packet schedules dev3_register_work (initialized via alps_reconnect()). The attacker must then hit a race by triggering device detachment (psmouse_disconnect) at the precise moment the delayed work fires. Limiting factors: the flaw is local-only (AV:L, PR:L per input vector - a low-privileged local session, not remote/unauthenticated), it is hardware-specific to ALPS touchpads with a chained PS/2 device, and success depends on winning a narrow timing window during disconnect, which materially reduces practical exploitability below the raw 7.8 score.
Impact

Signals are consistent and point to low real-world urgency despite a High CVSS. The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) reflects local-only reach, but the actual trigger is a narrow disconnect-versus-delayed-work race that in practice raises attack complexity, and it additionally requires physical ALPS touchpad hardware plus an externally chained PS/2 device - conditions unlikely on servers or cloud fleets. EPSS is 0.02% (6th percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no evidence of exploitation. The upstream tag 'Information Disclosure' understates the theoretical ceiling: a kernel heap UAF can in principle yield code execution or privilege escalation, but reliably weaponizing this specific timing window is difficult. Net: real but low-priority - patch on normal cadence rather than emergency. Note CWE is listed as N/A in the input; it is functionally a use-after-free, inferred from the description, not vendor-tagged.
Exploit ScenarioDerived

A local user with an affected ALPS-equipped laptop attaches an external PS/2 device through the touchpad to schedule dev3_register_work, then races a device teardown so the delayed work runs after alps_disconnect() frees the alps_data structure, corrupting freed kernel heap memory. Winning this timing window reliably is hard, and no public exploit or POC is referenced; the low-privilege local vector (PR:L, UI:N) means no separate authentication step beyond an existing local session.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 30, 2026

Local privilege-escalation-capable memory corruption in the Linux kernel's ALPS PS/2 touchpad driver (drivers/input/mouse/alps.c) lets a use-after-free be triggered when an ALPS touchpad is detached while the dev3_register_work delayed work item is still pending. Because psmouse_disconnect() only flushes work already queued, alps_register_bare_ps2_mouse() can run and dereference the alps_data structure (priv->dev3) after alps_disconnect() has kfree()'d it, corrupting freed kernel heap memory. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the flaw was found by static analysis rather than in-the-wild activity.

Earlier versions of this analysis (2)
v2 Jul 30, 2026 - 07:00 cvss changed CVSS 7.8

Local privilege escalation via use-after-free in Linux Kernel affects the ALPS PS/2 touchpad driver (drivers/input/mouse/alps.c), where the dev3_register_work delayed work item can execute after the alps_data structure is freed during device disconnect. Because psmouse_disconnect() only flushes work already queued and the work can be re-scheduled afterward, alps_disconnect() frees priv while alps_register_bare_ps2_mouse() still dereferences it, corrupting freed kernel memory. No public exploit identified at time of analysis and EPSS risk is very low (0.02%), but the CWE-416 flaw is a memory-corruption primitive with C:H/I:H/A:H impact.

v1 Mar 12, 2026 - 21:54

In the Linux kernel, the following vulnerability has been resolved:

Input: alps - fix use-after-free bugs caused by dev3_register_work

The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad.

RemediationAI

Apply the vendor-released kernel update that includes the disable_delayed_work_sync() fix in alps_disconnect(); the upstream fix is available as stable commits a9c115e017b2c633d25bdfe6709dda6fc36f08c2, bf40644ef8c8a288742fa45580897ed0e0289474, and ed8c61b89be0c45f029228b2913d5cf7b5cda1a7 (https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7). Ubuntu users should upgrade to the fixed kernel packages per USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot; other distributions ship the same backport. Where immediate patching is not possible, the exposure is bounded by requiring local access and ALPS touchpad hardware, so compensating controls include restricting physical access to affected laptops and, on systems that do not need it, blacklisting the psmouse/ALPS module (e.g. via modprobe blacklist) - with the trade-off that the built-in touchpad will stop functioning and fall back to a generic PS/2 or USB pointing device.

Affected ProductsAI

The affected product is the mainline and stable Linux kernel, specifically the ALPS touchpad input driver (drivers/input/mouse/alps.c). Only builds that include and load the ALPS PS/2 driver on systems with ALPS touchpad hardware are practically exposed. No CPE strings were provided in the input, so exact version ranges are not enumerated here; the fix is carried across multiple stable branches per the three git.kernel.org stable commits (a9c115e0, bf40644e, ed8c61b8). Distribution-level exposure is documented by Ubuntu in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and cross-listed at https://vuldb.com/vuln/340631.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in the PS/2 mouse subsystem's ALPS driver. dev3_register_work is a delayed workqueue item set up in alps_reconnect() and scheduled the first time a bare PS/2 packet arrives from an external PS/2 device chained through the ALPS touchpad. The root cause is a classic use-after-free (CWE-416) driven by a workqueue lifetime race: flush_workqueue() in psmouse_disconnect() waits only for items enqueued before it was called, so a work item scheduled after the flush survives, then executes container_of(work, alps_data, ...) and touches priv->dev3 after alps_disconnect() frees priv. The fix replaces the flush with disable_delayed_work_sync() inside alps_disconnect(), which both cancels any pending instance and prevents re-scheduling before the structure is freed.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local-only kernel UAF (AV:L, PR:L) gated by a disconnect-vs-delayed-work timing race and ALPS hardware, so AC:H; kernel heap corruption keeps C/I/A High.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Updated
Jul 30, 2026 - 07:02 vuln.today
v3 - CVSS changed
Analysis Updated
Jul 30, 2026 - 07:00 vuln.today
v2 - CVSS changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Input: alps - fix use-after-free bugs caused by dev3_register_work

The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected.

The race condition can occur as follows:

CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse()

| priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated.

This bug is identified by static analysis.

Executive ViewAI

Why It Matters

CVE-2025-68822 is a local privilege escalation vulnerability in the Linux kernel's ALPS PS/2 touchpad driver (CVSS 7.8) that enables attackers with local access to corrupt kernel memory and elevate privileges on affected systems. This affects organizations running Linux with ALPS touchpad hardware; systems without ALPS touchpads are unaffected. While no public exploit identified at time of analysis and current exploitation risk is minimal (EPSS 0.0%), the high CVSS score and privilege escalation capability warrant prompt patching.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 94% exploitable
Prevalence
High
ALPS touchpad driver ships in most Linux distros but needs ALPS hardware
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.162 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.176 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.193 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.148 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8177-1 ADVISORY https://vuldb.com/vuln/340631 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20555/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20570/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22393/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22394/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22433/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22436/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22440/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22458/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22460/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2450/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2722/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2799/ REF https://git.kernel.org/stable/c/55beb00222af2eee967322670a0c8f3c6426becb REF https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2 REF https://git.kernel.org/stable/c/b9d8cfd6d77f5072a4df10646810d128220457fb REF https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474 REF https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy