CVE-2025-68822

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Input: alps - fix use-after-free bugs caused by dev3_register_work

The dev3_register_work delayed work item is initialized within

alps_reconnect() and scheduled upon receipt of the first bare

PS/2 packet from an external PS/2 device connected to the ALPS

touchpad. During device detachment, the original implementation

calls flush_workqueue() in psmouse_disconnect() to ensure

completion of dev3_register_work. However, the flush_workqueue()

in psmouse_disconnect() only blocks and waits for work items that

were already queued to the workqueue prior to its invocation. Any

work items submitted after flush_workqueue() is called are not

included in the set of tasks that the flush operation awaits.

This means that after flush_workqueue() has finished executing,

the dev3_register_work could still be scheduled. Although the

psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),

the scheduling of dev3_register_work re

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References