Linux Kernel CVE-2025-68822

In the Linux kernel, the following vulnerability has been resolved:

Input: alps - fix use-after-free bugs caused by dev3_register_work

The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected.

The race condition can occur as follows:

CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse()

| priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated.

This bug is identified by static analysis.

The affected product is the mainline and stable Linux kernel, specifically the ALPS touchpad input driver (drivers/input/mouse/alps.c). Only builds that include and load the ALPS PS/2 driver on systems with ALPS touchpad hardware are practically exposed. No CPE strings were provided in the input, so exact version ranges are not enumerated here; the fix is carried across multiple stable branches per the three git.kernel.org stable commits (a9c115e0, bf40644e, ed8c61b8). Distribution-level exposure is documented by Ubuntu in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and cross-listed at https://vuldb.com/vuln/340631.