Към съдържанието
Търсене

CVE-2025-68822: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: Input: alps - fix use-after-free bugs caused by dev3_register_work The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis.

Засегнати продукти

  • Linux Linux: 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 преди 55beb00222af2eee967322670a0c8f3c6426becb; 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 преди b9d8cfd6d77f5072a4df10646810d128220457fb; 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 преди ed8c61b89be0c45f029228b2913d5cf7b5cda1a7; 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 преди a9c115e017b2c633d25bdfe6709dda6fc36f08c2; 04aae283ba6a8cd4851d937bf9c6d6ef0361d794 преди bf40644ef8c8a288742fa45580897ed0e0289474
  • Linux Linux: 4.0; преди 4.0; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.64 до 6.12.*; 6.18.3 до 6.18.*; от 6.19 нататък

Вид слабост

История

  • 13 януари 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2025-68822: Linux, грешка в паметта | freedomonline.bg