CVE-2025-38478

MEDIUM EPSS 5.2%

Published Jul 28, 202511mo ago · Modified Jun 17, 20262w ago

5.5 CVSS 3.1

Medium

Published Jul 28, 2025 11mo ago

Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

5.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-908

Affected Products 14

Vendor	Product	Version	Range
linux	linux_kernel	*	≥2.6.29 – <5.4.297
linux	linux_kernel	*	≥5.5 – <5.10.241
linux	linux_kernel	*	≥5.11 – <5.15.190
linux	linux_kernel	*	≥5.16 – <6.1.147
linux	linux_kernel	*	≥6.2 – <6.6.100
linux	linux_kernel	*	≥6.7 – <6.12.40
linux	linux_kernel	*	≥6.13 – <6.15.8
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
linux	linux_kernel	6.16	any
debian	debian_linux	11.0	any

References 10

git.kernel.org https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c

Patch
git.kernel.org https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4

Patch
git.kernel.org https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e

Patch
git.kernel.org https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4

Patch
git.kernel.org https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02

Patch
git.kernel.org https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649

Patch
git.kernel.org https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29

Patch
git.kernel.org https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9

Patch
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

Mailing ListThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html

Mailing ListThird Party Advisory

Remediation

git.kernel.org https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c

Patch
git.kernel.org https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4

Patch
git.kernel.org https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e

Patch
git.kernel.org https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4

Patch
git.kernel.org https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02

Patch
git.kernel.org https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649

Patch
git.kernel.org https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29

Patch
git.kernel.org https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9

Patch