PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-68822 Linux CVE debrief

A use-after-free vulnerability was found in the Linux kernel's ALPS touchpad driver. The dev3_register_work delayed work item was not properly canceled during device detachment, allowing it to be scheduled after the alps_data structure had been deallocated. This can cause a use-after-free vulnerability in the Linux kernel's ALPS touchpad driver. The vulnerability can be mitigated by applying the patches provided by the vendor or disabling the ALPS touchpad driver if not needed. Linux kernel developers and users who use the ALPS touchpad driver should be aware of this vulnerability and take steps to mitigate it. This includes applying the patches provided by the vendor or disabling the ALPS touchpad driver if not needed. Additionally, defenders should monitor for suspicious activity related to the ALPS touchpad driver and review compensating controls for exposed systems. The vulnerability was identified by static analysis of the Linux kernel's ALPS touchpad driver code. The analysis revealed that the dev3_register_work delayed work item was not properly canceled during device detachment, allowing it to be scheduled after the alps_data structure had been deallocated.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-13
Original CVE updated
2026-07-30
Advisory published
2026-01-13
Advisory updated
2026-07-30

Who should care

Linux kernel developers and users who use the ALPS touchpad driver should be aware of this vulnerability and take steps to mitigate it. This includes applying the patches provided by the vendor or disabling the ALPS touchpad driver if not needed. Additionally, defenders should monitor for suspicious activity related to the ALPS touchpad driver and review compensating controls for exposed systems.

Technical summary

The dev3_register_work delayed work item was not properly canceled during device detachment, allowing it to be scheduled after the alps_data structure had been deallocated. This can cause a use-after-free vulnerability in the Linux kernel's ALPS touchpad driver. The vulnerability can be mitigated by applying the patches provided by the vendor or disabling the ALPS touchpad driver if not needed. The vulnerability was identified by static analysis of the Linux kernel's ALPS touchpad driver code. The analysis revealed that the dev3_register_work delayed work item was not properly canceled during device detachment, allowing it to be scheduled after the alps_data structure had been deallocated. Defenders should verify that the ALPS touchpad driver is properly updated and configured, and monitor for suspicious activity related to the driver.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from https://git.kernel.org/stable/c/a9c115e017b2c633d25bdfe6709dda6fc36f08c2
  • Apply the patch from https://git.kernel.org/stable/c/bf40644ef8c8a288742fa45580897ed0e0289474
  • Apply the patch from https://git.kernel.org/stable/c/ed8c61b89be0c45f029228b2913d5cf7b5cda1a7
  • Disable the ALPS touchpad driver if not needed
  • Monitor for suspicious activity related to the ALPS touchpad driver
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was identified by static analysis of the Linux kernel's ALPS touchpad driver code. The analysis revealed that the dev3_register_work delayed work item was not properly canceled during device detachment, allowing it to be scheduled after the alps_data structure had been deallocated. This can cause a use-after-free vulnerability. Defenders should verify that the ALPS touchpad driver is properly updated and configured, and monitor for suspicious activity related to the driver.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-01-13T16:16:04.550Z and has not been modified since then.