CVE-2025-68367 in Linux
Sumário
de VulDB • 28/05/2026
No kernel do Linux, a seguinte vulnerabilidade foi resolvida:
macintosh/mac_hid: corrige race condition em mac_hid_toggle_emumouse
O seguinte aviso aparece ao executar o syzkaller, e este problema também existe no código principal (mainline).
------------[ cut here ]------------
list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa57eee28 R13: 0000000000000000 R14: ffffffffa57eee18 R15: ffffffffa57eee28 FS: 00007f773ef00700(0000) GS:ffff97fc98000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f773ef00700 CR3: 0000000000773ef0 CR4: 0000000000000000 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2
O WARNING ocorre quando dois processos escrevem simultaneamente no sysctl de emulação mac-hid, causando uma condição de corrida em mac_hid_toggle_emumouse(). Ambos os processos leem old_val=0, então ambos tentam registrar o manipulador de entrada, levando a um double list_add do mesmo manipulador.
CPU0 CPU1 ------------------------- ------------------------- vfs_write() //write 1 vfs_write() //write 1 proc_sys_write() proc_sys_write() mac_hid_toggle_emumouse() mac_hid_toggle_emumouse() old_val = *valp // old_val=0 old_val = *valp // old_val=0 mutex_lock_killable() proc_dointvec() // *valp=1 mac_hid_start_emulation() input_register_handler() mutex_unlock() mutex_lock_killable() proc_dointvec() mac_hid_start_emulation() input_register_handler() //Trigger Warning mutex_unlock()
Corrige isso movendo a leitura de old_val para dentro da região de bloqueio do mutex.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.