{"id":"CVE-2025-68367","summary":"macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse\n\nThe following warning appears when running syzkaller, and this issue also\nexists in the mainline code.\n\n ------------[ cut here ]------------\n list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.\n WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130\n Modules linked in:\n CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__list_add_valid_or_report+0xf7/0x130\n RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282\n RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817\n RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001\n RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c\n R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100\n R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48\n FS:  00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 80000000\n Call Trace:\n  \u003cTASK\u003e\n  input_register_handler+0xb3/0x210\n  mac_hid_start_emulation+0x1c5/0x290\n  mac_hid_toggle_emumouse+0x20a/0x240\n  proc_sys_call_handler+0x4c2/0x6e0\n  new_sync_write+0x1b1/0x2d0\n  vfs_write+0x709/0x950\n  ksys_write+0x12a/0x250\n  do_syscall_64+0x5a/0x110\n  entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe WARNING occurs when two processes concurrently write to the mac-hid\nemulation sysctl, causing a race condition in mac_hid_toggle_emumouse().\nBoth processes read old_val=0, then both try to register the input handler,\nleading to a double list_add of the same handler.\n\n  CPU0                             CPU1\n  -------------------------        -------------------------\n  vfs_write() //write 1            vfs_write()  //write 1\n    proc_sys_write()                 proc_sys_write()\n      mac_hid_toggle_emumouse()          mac_hid_toggle_emumouse()\n        old_val = *valp // old_val=0\n                                           old_val = *valp // old_val=0\n                                           mutex_lock_killable()\n                                           proc_dointvec() // *valp=1\n                                           mac_hid_start_emulation()\n                                             input_register_handler()\n                                           mutex_unlock()\n        mutex_lock_killable()\n        proc_dointvec()\n        mac_hid_start_emulation()\n          input_register_handler() //Trigger Warning\n        mutex_unlock()\n\nFix this by moving the old_val read inside the mutex lock region.","modified":"2026-03-31T17:29:42.674278Z","published":"2025-12-24T10:32:54.084Z","related":["SUSE-SU-2026:0447-1","SUSE-SU-2026:0472-1","SUSE-SU-2026:0473-1","SUSE-SU-2026:0587-1","SUSE-SU-2026:20477-1","SUSE-SU-2026:20498-1","SUSE-SU-2026:20555-1","SUSE-SU-2026:20599-1","SUSE-SU-2026:20615-1","SUSE-SU-2026:20845-1","SUSE-SU-2026:20876-1","openSUSE-SU-2026:10039-1","openSUSE-SU-2026:10301-1","openSUSE-SU-2026:20287-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68367.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/14c209835e47a87e6da94bb9401e570dcc14f31f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/230621ffdb361d15cd3ef92d8b4fa8d314f4fad4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/388391dd1cc567fcf0b372b63d414c119d23e911"},{"type":"WEB","url":"https://git.kernel.org/stable/c/48a7d427eb65922b3f17fbe00e2bbc7cb9eac381"},{"type":"WEB","url":"https://git.kernel.org/stable/c/583d36523f56d8e9ddfa0bec20743a6faefc9b74"},{"type":"WEB","url":"https://git.kernel.org/stable/c/61abf8c3162d155b4fd0fb251f08557093363a0a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d5f1d40fd342b589420de7508b4c748fcf28122e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68367.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68367"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"99b089c3c38a83ebaeb1cc4584ddcde841626467"},{"fixed":"d5f1d40fd342b589420de7508b4c748fcf28122e"},{"fixed":"14c209835e47a87e6da94bb9401e570dcc14f31f"},{"fixed":"583d36523f56d8e9ddfa0bec20743a6faefc9b74"},{"fixed":"61abf8c3162d155b4fd0fb251f08557093363a0a"},{"fixed":"230621ffdb361d15cd3ef92d8b4fa8d314f4fad4"},{"fixed":"388391dd1cc567fcf0b372b63d414c119d23e911"},{"fixed":"48a7d427eb65922b3f17fbe00e2bbc7cb9eac381"},{"fixed":"1e4b207ffe54cf33a4b7a2912c4110f89c73bf3f"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68367.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.34"},{"fixed":"5.10.248"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.198"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.120"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.63"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.17.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.18.0"},{"fixed":"6.18.2"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68367.json"}}],"schema_version":"1.7.5"}