CVE-2025-68822

In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis.

• https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2
• https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474
• https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7

Published

Jan 13, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68817In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-68818In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2025-68819In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2025-6882A vulnerability classified as critical has been found in D-L…8.8
• CVE-2025-68820In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68821In the Linux kernel, the following vulnerability has been re…
• CVE-2025-68823In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-6883A vulnerability classified as critical was found in code-pro…6.3
• CVE-2025-68834Missing Authorization vulnerability in Saiful Islam Sync Mas…7.5
• CVE-2025-68835Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-68836Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-68837Missing Authorization vulnerability in ELEXtensions ELEX Wor…6.5