CVE-2025-68822

A use-after-free flaw was found in the Linux kernel's ALPS touchpad driver. A race condition exists between device disconnection and the dev3_register_work delayed work item. During disconnect, the alps_data structure can be freed while the delayed work is still executing, causing the work function to access freed memory.

This requires physical interaction involving an ALPS touchpad with an external PS/2 device and specific timing during device disconnection. The issue was found through static analysis. Systems without ALPS touchpads are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.