CVE-2025-38478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38478", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.021Z", "datePublished": "2025-07-28T11:21:44.210Z", "dateUpdated": "2026-10-15T21:52:17.239Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:15.495Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn->n` elements in some\ncases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that. For Comedi instruction codes\nthat write to the subdevice, the first `insn->n` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized. That could be a problem if the subdevice instruction\nhandler reads the uninitialized data. Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0. For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only entry point is the COMEDI_INSN/COMEDI_INSNLIST ioctl issued on a local /dev/comediN character device (comedi_unlocked_ioctl, comedi_fops.c:2253/2280). No network, remote-peer, or adjacent-network data path reaches this code.\nAC:L - The attacker deterministically triggers the bug with a single ioctl by setting insn->n smaller than what the handler reads (e.g. INSN_CONFIG with an ID that falls through check_insn_config_length()'s permissive default arm) \u2014 no race, no timing window, no condition outside attacker control, and the kmalloc-64 slab contents can be groomed beforehand to influence the uninitialized bytes.\nPR:L - Unlike COMEDI_DEVCONFIG, the instruction ioctls carry no capable() check whatsoever \u2014 comedi_open() demands CAP_SYS_ADMIN only for an unattached device, and PCI/USB boards auto-attach at probe via comedi_pci_auto_config()/comedi_usb_auto_config(), so any unprivileged user holding an fd on the comedi node (comedi's standard group-permission model) can drive the path.\nUI:N - The attacker performs the entire attack with self-issued ioctls on a file descriptor it opens itself; no victim action, mount, or interaction by another user is required.\nS:U - The uninitialized read and its consequences stay entirely within the kernel's own security authority on the same host, with no crossing of a VM, IOMMU, container, or sandbox boundary.\nC:H - Up to 60 bytes of uninitialized kernel slab memory \u2014 potentially containing heap and kernel pointers usable to defeat KASLR \u2014 are consumed by subdevice handlers and pushed into device registers that the same unprivileged caller can read back through comedi read/get instructions (s526 preload\u2192counter read, NI routing/filter set\u2192get, 8254 load\u2192read), and this identical buffer was the subject of a confirmed syzbot KMSAN kernel-infoleak.\nI:H - Uninitialized heap words bypass parse_insn()'s maxdata range validation (which only covers the first insn->n elements) and are written directly into counter mode/preload, PWM, routing and edge-detection/interrupt registers plus driver state (devpriv->gpct_config, io_bits, readback caches), so both kernel-side driver state and the hardware controlling the attached physical process are modified with values neither the user nor the driver validated.\nA:H - Programming interrupt/edge-detection and counter-mode registers with random heap contents can leave the board asserting spurious interrupts or wedged in an invalid state \u2014 an IRQ storm or livelock on a shared line \u2014 and the uninitialized read is itself undefined behaviour that is fatal on KMSAN-instrumented and panic_on_warn hardened kernels."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c"], "versions": [{"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "6f38c6380c3b38a05032b8881e41137385a6ce02", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "13e4d9038a1e869445a996a3f604a84ef52fe8f4", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "020eed5681d0f9bced73970368078a92d6cfaa9c", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "d3436638738ace8f101af7bdee2eae1bc38e9b29", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "673ee92bd2d31055bca98a1d96b653f5284289c4", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "c42116dc70af6664526f7aa82cf937824ab42649", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9", "status": "affected", "versionType": "git"}, {"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "46d8c744136ce2454aa4c35c138cc06817f92b8e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c"], "versions": [{"version": "2.6.29", "status": "affected"}, {"version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.147", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.8", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.4.297"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.10.241"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.147"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.15.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02"}, {"url": "https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4"}, {"url": "https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c"}, {"url": "https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29"}, {"url": "https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4"}, {"url": "https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649"}, {"url": "https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9"}, {"url": "https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e"}], "title": "comedi: Fix initialization of data for instructions that write to subdevice", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:46.621Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38478", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:50.290792Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:17.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:38:46.621Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38478", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:50.290792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:50:51.279Z"}}], "cna": {"title": "comedi: Fix initialization of data for instructions that write to subdevice", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only entry point is the COMEDI_INSN/COMEDI_INSNLIST ioctl issued on a local /dev/comediN character device (comedi_unlocked_ioctl, comedi_fops.c:2253/2280). No network, remote-peer, or adjacent-network data path reaches this code.\nAC:L - The attacker deterministically triggers the bug with a single ioctl by setting insn->n smaller than what the handler reads (e.g. INSN_CONFIG with an ID that falls through check_insn_config_length()'s permissive default arm) \u2014 no race, no timing window, no condition outside attacker control, and the kmalloc-64 slab contents can be groomed beforehand to influence the uninitialized bytes.\nPR:L - Unlike COMEDI_DEVCONFIG, the instruction ioctls carry no capable() check whatsoever \u2014 comedi_open() demands CAP_SYS_ADMIN only for an unattached device, and PCI/USB boards auto-attach at probe via comedi_pci_auto_config()/comedi_usb_auto_config(), so any unprivileged user holding an fd on the comedi node (comedi's standard group-permission model) can drive the path.\nUI:N - The attacker performs the entire attack with self-issued ioctls on a file descriptor it opens itself; no victim action, mount, or interaction by another user is required.\nS:U - The uninitialized read and its consequences stay entirely within the kernel's own security authority on the same host, with no crossing of a VM, IOMMU, container, or sandbox boundary.\nC:H - Up to 60 bytes of uninitialized kernel slab memory \u2014 potentially containing heap and kernel pointers usable to defeat KASLR \u2014 are consumed by subdevice handlers and pushed into device registers that the same unprivileged caller can read back through comedi read/get instructions (s526 preload\u2192counter read, NI routing/filter set\u2192get, 8254 load\u2192read), and this identical buffer was the subject of a confirmed syzbot KMSAN kernel-infoleak.\nI:H - Uninitialized heap words bypass parse_insn()'s maxdata range validation (which only covers the first insn->n elements) and are written directly into counter mode/preload, PWM, routing and edge-detection/interrupt registers plus driver state (devpriv->gpct_config, io_bits, readback caches), so both kernel-side driver state and the hardware controlling the attached physical process are modified with values neither the user nor the driver validated.\nA:H - Programming interrupt/edge-detection and counter-mode registers with random heap contents can leave the board asserting spurious interrupts or wedged in an invalid state \u2014 an IRQ storm or livelock on a shared line \u2014 and the uninitialized read is itself undefined behaviour that is fatal on KMSAN-instrumented and panic_on_warn hardened kernels."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "6f38c6380c3b38a05032b8881e41137385a6ce02", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "13e4d9038a1e869445a996a3f604a84ef52fe8f4", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "020eed5681d0f9bced73970368078a92d6cfaa9c", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "d3436638738ace8f101af7bdee2eae1bc38e9b29", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "673ee92bd2d31055bca98a1d96b653f5284289c4", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "c42116dc70af6664526f7aa82cf937824ab42649", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9", "versionType": "git"}, {"status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "lessThan": "46d8c744136ce2454aa4c35c138cc06817f92b8e", "versionType": "git"}], "programFiles": ["drivers/comedi/comedi_fops.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.29", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.297", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.241", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.147", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.100", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.40", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.8", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/comedi/comedi_fops.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02"}, {"url": "https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4"}, {"url": "https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c"}, {"url": "https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29"}, {"url": "https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4"}, {"url": "https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649"}, {"url": "https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9"}, {"url": "https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn->n` elements in some\ncases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that. For Comedi instruction codes\nthat write to the subdevice, the first `insn->n` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized. That could be a problem if the subdevice instruction\nhandler reads the uninitialized data. Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0. For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.297", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.241", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.190", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.147", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.100", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.40", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.8", "versionStartIncluding": "2.6.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "2.6.29"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:15.495Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38478", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:17.239Z", "dateReserved": "2025-04-16T04:51:24.021Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-07-28T11:21:44.210Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6f38c6380c3b38a05032b8881e41137385a6ce02", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "13e4d9038a1e869445a996a3f604a84ef52fe8f4", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "020eed5681d0f9bced73970368078a92d6cfaa9c", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "d3436638738ace8f101af7bdee2eae1bc38e9b29", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "673ee92bd2d31055bca98a1d96b653f5284289c4", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "c42116dc70af6664526f7aa82cf937824ab42649", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}, {"lessThan": "46d8c744136ce2454aa4c35c138cc06817f92b8e", "status": "affected", "version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.29"}, {"lessThan": "2.6.29", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.297", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.241", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.147", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.100", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B9F2FDF6-4EB5-4DFF-BC93-F12605A32B6E", "versionEndExcluding": "5.4.297", "versionStartIncluding": "2.6.29", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1", "versionEndExcluding": "6.1.147", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "094B81E0-B756-4727-85CA-F3F8D1C9D116", "versionEndExcluding": "6.6.100", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030", "versionEndExcluding": "6.12.40", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746", "versionEndExcluding": "6.15.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "85421F4E-C863-4ABF-B4B4-E887CC2F7F92", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "3827F0D4-5FEE-4181-B267-5A45E7CA11FC", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn->n` elements in some\ncases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that. For Comedi instruction codes\nthat write to the subdevice, the first `insn->n` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized. That could be a problem if the subdevice instruction\nhandler reads the uninitialized data. Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0. For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: comedi: Se corrige la inicializaci\u00f3n de datos para instrucciones que escriben en el subdispositivo Se sabe que algunos controladores de instrucciones del subdispositivo Comedi acceden a elementos de datos de instrucci\u00f3n m\u00e1s all\u00e1 de los primeros elementos `insn->n` en algunos casos. Las funciones `do_insn_ioctl()` y `do_insnlist_ioctl()` asignan al menos `MIN_SAMPLES` (16) elementos de datos para lidiar con esto, pero no inicializan todo eso. Para los c\u00f3digos de instrucci\u00f3n Comedi que escriben en el subdispositivo, los primeros elementos de datos `insn->n` se copian del espacio de usuario, pero los elementos restantes se dejan sin inicializar. Eso podr\u00eda ser un problema si el controlador de instrucciones del subdispositivo lee los datos no inicializados. Aseg\u00farese de que los primeros elementos `MIN_SAMPLES` se inicialicen antes de llamar a estos controladores de instrucciones, llenando los elementos no copiados con 0. Para `do_insnlist_ioctl()`, se utilizan los mismos elementos del b\u00fafer de datos para manejar una lista de instrucciones, as\u00ed que aseg\u00farese de que los primeros elementos `MIN_SAMPLES` se inicialicen para cada instrucci\u00f3n que escriba en el subdispositivo."}], "id": "CVE-2025-38478", "lastModified": "2026-10-15T22:18:42.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38478", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:50:50.290792Z", "version": "2.0.3"}}]}, "published": "2025-07-28T12:15:29.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: comedi: Fix initialization of data for instructions that write to subdevice", "id": "2383920", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383920"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38478", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38478\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38478\nhttps://lore.kernel.org/linux-cve-announce/2025072814-CVE-2025-38478-298f@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-29T07:59:28.937554+00:00", "updated": "2025-07-29T07:59:28.937624+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}