CVE-2025-68822

What it actually does

Race condition in ALPS touchpad driver allows dev3_register_work delayed work to execute after psmouse_disconnect frees the alps_data structure, resulting in use-after-free.

Why it matters to the business

Linux systems using ALPS touchpads face risk of kernel crashes or memory corruption that can lead to denial of service or potential privilege escalation; urgency is low given absence from known exploitation lists and modest EPSS growth.

How an attack unfolds

An attacker with local access triggers repeated attach/detach of an external PS/2 device connected to an ALPS touchpad, racing the cleanup path that frees private data against the delayed work item that dereferences it after free.

How to fix it

Apply the upstream fix in commit ed8c61b89be0c45f029228b2913d5cf7b5cda1a7 or later; rebuild and deploy updated kernel packages to all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit ed8c61b89be0c45f029228b2913d5cf7b5cda1a7 or equivalent backport; confirm absence of the original flush_workqueue pattern in alps_disconnect and presence of disable_delayed_work_sync.

Typical attack path

1. Attach external PS/2 device to ALPS touchpad
2. Trigger alps_reconnect and queue dev3_register_work via bare PS/2 packet
3. Initiate psmouse_disconnect while work is still pending
4. Execute flush_workqueue which misses newly queued work
5. Free alps_data structure
6. Delayed work runs and performs container_of plus field accesses on freed memory

How to detect it

Review kernel crash logs for use-after-free signatures involving alps_data or psmouse structures; inspect audit logs for repeated PS/2 device attach/detach events around the time of any kernel oops or panic.

What your security team should do

• Prioritize kernel update on any system exposing ALPS hardware within the next maintenance window
• Monitor EPSS trend and CISA KEV additions for escalation to immediate patching
• Harden local access controls until patches are deployed