CVE-2025-68367
Race Condition in Linux mac_hid Causes Double Handler Registration
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition in the Linux kernel's mac_hid_toggle_emumouse function. When two processes concurrently write to the mac-hid emulation sysctl, both read the old value as 0 and then both try to register the same input handler simultaneously. This causes a double addition of the same handler to a list, triggering a warning and indicating improper synchronization. The issue is fixed by moving the read of the old value inside a mutex lock to prevent concurrent access.
How can this vulnerability impact me? :
This vulnerability can cause a race condition leading to a double addition of the same input handler in the kernel, which may result in kernel warnings and potential instability or unexpected behavior in the system. While the description does not specify direct exploitation consequences, race conditions in kernel code can lead to system crashes or unpredictable behavior.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing the kernel warning message related to a double list_add in mac_hid_toggle_emumouse. Specifically, look for the warning: 'list_add double add: new=..., prev=..., next=...'. This warning appears in the kernel logs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition. You can check the kernel logs using the command: dmesg | grep 'list_add double add' or journalctl -k | grep 'list_add double add'.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, avoid running concurrent writes to the mac-hid emulation sysctl to prevent triggering the race condition. Applying the patch that moves the old_val read inside the mutex lock region in mac_hid_toggle_emumouse is the definitive fix. Until the patch is applied, limit or serialize access to the mac-hid emulation sysctl to prevent concurrent writes.