Look up another CVE · open CVE-2025-68822 in the interactive tracker
CVE-2025-68822
Input: alps - fix use-after-free bugs caused by dev3_register_work
Published 2026-01-13 (9 months ago) by the Linux kernel CNA. Subsystem drivers/input. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2025-68822 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6126-1 · 2026-02-09 · text | 6.12.69-1 | Update the kernel and reboot. DSA-6126-1 shipped the fix on 2026-02-09, in 6.12.69-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.18.3-1 | Update the kernel and reboot. Fixed in 6.18.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.18.3-1 | Update the kernel and reboot. Fixed in 6.18.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/input/mouse/alps.c
- What this is
- ALPS PS/2 TOUCHPAD DRIVERMAINTAINERS section matched on drivers/input/mouse/alps.*
- Kernel module
- psmouse
Check it on the machine
grep -wE 'CONFIG_INPUT|CONFIG_INPUT_MOUSE|CONFIG_MOUSE_PS2|CONFIG_MOUSE_PS2_ALPS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w psmousePrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidBnot built on amd64/cloud-amd64, arm64/cloud-arm64
- B
- built in on some, a module on others, absent on the rest
- Build switches
- CONFIG_INPUT, CONFIG_INPUT_MOUSE, CONFIG_MOUSE_PS2, CONFIG_MOUSE_PS2_ALPS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-01-13 (9 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.15%, higher than 3.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/input
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.0 | 6.12.64 | ed8c61b89be0 |
| 4.0 | 6.18.3 | a9c115e017b2 |
| 4.0 | 6.19 | bf40644ef8c8 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6126-1 | 2026-02-09 | trixie 6.12.69-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The SERIO_8042 byte stream is locally reachable through the userio serio-emulation device, leading through serio_interrupt(), ps2_interrupt(), and alps_process_byte() to the vulnerable path. In a reasonable deployment granting an input-testing account access to /dev/userio, direct physical access is unnecessary.
- AC:LAttack complexity, low
- The attacker can provoke reconnect failure and concurrently inject the first bare PS/2 packet during disconnect, controlling both sides of the race and allowing repeated attempts. No condition inherently outside the attacker's control is required.
- PR:LPrivileges required, low
- The userio command path contains no capability check; a basic local account with device-file access can emulate a SERIO_8042 ALPS device, inject packets, and provoke teardown. Init-namespace root is not intrinsically required.
- UI:NUser interaction, none
- The attacker can drive device emulation, reconnect failure, packet delivery, and the resulting race without any victim action.
- S:UScope, unchanged
- The vulnerable worker and resulting corruption execute within the host kernel's existing security authority; ordinary kernel privilege escalation does not cross a separate security scope.
- C:HConfidentiality impact, high
- The worker dereferences attacker-reclaimable alps_data, psmouse, and serio objects after free. Reclaiming the embedded pending work object can provide controlled kernel-pointer dereferences and ultimately arbitrary kernel-memory disclosure.
- I:HIntegrity impact, high
- The stale worker writes an input-device pointer and physical-path string into freed memory, while the embedded work_struct and its function pointer are themselves reclaimable. This supports heap corruption, arbitrary writes, and control-flow hijacking.
- A:HAvailability impact, high
- Executing a delayed work item from freed storage can immediately cause invalid pointer dereferences, corrupted workqueue state, an oops, or a kernel panic, and the trigger can be retried.