Executive brief
A vulnerability in the Linux kernel's ALPS touchpad driver could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when an external mouse is disconnected from an ALPS touchpad, leading to a memory error known as a use-after-free. This could impact system stability and availability in environments where users have physical or local access to hardware.
Technical details
A use-after-free vulnerability exists in the ALPS touchpad driver (drivers/input/mouse/alps.c) within the Linux kernel. The root cause is a race condition between the device disconnection path (alps_disconnect) and a delayed work item (dev3_register_work) used for external PS/2 devices. While psmouse_disconnect calls flush_workqueue, it fails to account for work items queued after the flush begins. Consequently, the 'priv' data structure can be freed while the delayed work is still scheduled to run, leading to a use-after-free when the work item eventually executes. The fix involves using disable_delayed_work_sync() to ensure all pending work is canceled before memory deallocation.
Affected products
- Linux Linux Kernel 4.0 to 6.12.64, 6.18.3
Timeline
- 2025-12-17: patched: Initial fix authored by Duoming Zhou
- 2026-01-13: advisory: CVE-2025-68822 published