CVE-2025-38687

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38687", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.032Z", "datePublished": "2025-09-04T15:32:41.702Z", "dateUpdated": "2026-08-05T12:03:57.908Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:03:57.908Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix race between polling and detaching\n\nsyzbot reports a use-after-free in comedi in the below link, which is\ndue to comedi gladly removing the allocated async area even though poll\nrequests are still active on the wait_queue_head inside of it. This can\ncause a use-after-free when the poll entries are later triggered or\nremoved, as the memory for the wait_queue_head has been freed. We need\nto check there are no tasks queued on any of the subdevices' wait queues\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\nioctl.\n\nTasks will read-lock `dev->attach_lock` before adding themselves to the\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\nhandler by write-locking `dev->attach_lock` before checking that all of\nthe subdevices are safe to be deleted. This includes testing for any\nsleepers on the subdevices' wait queues. It remains locked until the\ndevice has been detached. This requires the `comedi_device_detach()`\nfunction to be refactored slightly, moving the bulk of it into new\nfunction `comedi_device_detach_locked()`.\n\nNote that the refactor of `comedi_device_detach()` results in\n`comedi_device_cancel_all()` now being called while `dev->attach_lock`\nis write-locked, which wasn't the case previously, but that does not\nmatter.\n\nThanks to Jens Axboe for diagnosing the problem and co-developing this\npatch."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access to a comedi character device node (`/dev/comediN`) to issue `poll`/`epoll_ctl` and `COMEDI_DEVCONFIG` ioctls. There is no network-facing path into the comedi core.\nAC:L - With epoll the wait-queue registration persists indefinitely after `comedi_poll()` returns, so no race window has to be won \u2014 the attacker deterministically leaves a dangling entry on `&s->async->wait_head` and controls when the freed object is dereferenced (`EPOLL_CTL_DEL`/`close`), leaving ample time to reclaim the freed slab.\nPR:L - `comedi_open()` imposes no capability check on an already-attached device, so an ordinary user with access to `/dev/comediN` \u2014 the standard configuration on DAQ/lab/industrial hosts where udev grants board access to a user group \u2014 can register the poll entry that becomes the dangling reference.\nUI:R - The free itself comes from `COMEDI_DEVCONFIG` (or driver teardown), which is gated on `capable(CAP_SYS_ADMIN)` in the init user namespace, so a separate privileged user must perform the routine detach/reconfiguration that triggers the planted use-after-free.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `wait_queue_head_t` lets the attacker reclaim the freed `struct comedi_async` with a controlled object and read back kernel list pointers, and a working write primitive from the same UAF enables arbitrary kernel memory disclosure.\nI:H - `remove_wait_queue()`/`ep_remove_wait_queue()` perform `spin_lock` and `list_del` on the freed, attacker-reclaimed memory, giving a classic unlink write of attacker-chosen pointers into attacker-chosen addresses \u2014 sufficient for privilege escalation.\nA:H - Even without successful exploitation the use-after-free on the wait queue head reliably corrupts the slab and oopses or panics the kernel, and it can be triggered repeatedly."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "versions": [{"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "fe67122ba781df44a1a9716eb1dfd751321ab512", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "cd4286123d6948ff638ea9cd5818ae4796d5d252", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "d85fac8729c9acfd72368faff1d576ec585e5c8f", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "0f989f9d05492028afd2bded4b42023c57d8a76e", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "017198079551a2a5cf61eae966af3c4b145e1f3b", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "71ca60d2e631cf9c63bcbc7017961c61ff04e419", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "5724e82df4f9a4be62908362c97d522d25de75dd", "status": "affected", "versionType": "git"}, {"version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "35b6fc51c666fc96355be5cd633ed0fe4ccf68b2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.43", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.11", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.2", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.4.297"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.241"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.12.43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.16.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512"}, {"url": "https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252"}, {"url": "https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f"}, {"url": "https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e"}, {"url": "https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4"}, {"url": "https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b"}, {"url": "https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419"}, {"url": "https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd"}, {"url": "https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2"}], "title": "comedi: fix race between polling and detaching", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:41:14.570Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:05:27.295Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fe67122ba781df44a1a9716eb1dfd751321ab512", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "cd4286123d6948ff638ea9cd5818ae4796d5d252", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "d85fac8729c9acfd72368faff1d576ec585e5c8f", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "0f989f9d05492028afd2bded4b42023c57d8a76e", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "017198079551a2a5cf61eae966af3c4b145e1f3b", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "71ca60d2e631cf9c63bcbc7017961c61ff04e419", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "5724e82df4f9a4be62908362c97d522d25de75dd", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}, {"lessThan": "35b6fc51c666fc96355be5cd633ed0fe4ccf68b2", "status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.297", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.241", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.43", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.11", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "70083655-66F5-4925-B3B5-21D2434F71E5", "versionEndExcluding": "5.4.297", "versionStartIncluding": "3.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix race between polling and detaching\n\nsyzbot reports a use-after-free in comedi in the below link, which is\ndue to comedi gladly removing the allocated async area even though poll\nrequests are still active on the wait_queue_head inside of it. This can\ncause a use-after-free when the poll entries are later triggered or\nremoved, as the memory for the wait_queue_head has been freed. We need\nto check there are no tasks queued on any of the subdevices' wait queues\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\nioctl.\n\nTasks will read-lock `dev->attach_lock` before adding themselves to the\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\nhandler by write-locking `dev->attach_lock` before checking that all of\nthe subdevices are safe to be deleted. This includes testing for any\nsleepers on the subdevices' wait queues. It remains locked until the\ndevice has been detached. This requires the `comedi_device_detach()`\nfunction to be refactored slightly, moving the bulk of it into new\nfunction `comedi_device_detach_locked()`.\n\nNote that the refactor of `comedi_device_detach()` results in\n`comedi_device_cancel_all()` now being called while `dev->attach_lock`\nis write-locked, which wasn't the case previously, but that does not\nmatter.\n\nThanks to Jens Axboe for diagnosing the problem and co-developing this\npatch."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: corregir condici\u00f3n de carrera entre el sondeo y la desconexi\u00f3n\n\nsyzbot informa de un uso despu\u00e9s de liberaci\u00f3n en comedi en el enlace de abajo, lo cual se debe a que comedi elimina alegremente el \u00e1rea as\u00edncrona asignada a pesar de que las solicitudes de sondeo siguen activas en la wait_queue_head dentro de ella. Esto puede causar un uso despu\u00e9s de liberaci\u00f3n cuando las entradas de sondeo se activan o eliminan posteriormente, ya que la memoria para la wait_queue_head ha sido liberada. Necesitamos verificar que no hay tareas en cola en ninguna de las colas de espera de los subdispositivos antes de permitir que el dispositivo sea desconectado por el ioctl 'COMEDI_DEVCONFIG'.\n\nLas tareas bloquear\u00e1n en modo lectura 'dev->attach_lock' antes de a\u00f1adirse a la cola de espera del subdispositivo, as\u00ed que se corrige el problema en el gestor del ioctl 'COMEDI_DEVCONFIG' bloqueando en modo escritura 'dev->attach_lock' antes de verificar que todos los subdispositivos son seguros para ser eliminados. Esto incluye probar si hay procesos en espera en las colas de espera de los subdispositivos. Permanece bloqueado hasta que el dispositivo ha sido desconectado. Esto requiere que la funci\u00f3n 'comedi_device_detach()' sea refactorizada ligeramente, moviendo la mayor parte de ella a la nueva funci\u00f3n 'comedi_device_detach_locked()'.\n\nTenga en cuenta que la refactorizaci\u00f3n de 'comedi_device_detach()' resulta en que 'comedi_device_cancel_all()' ahora se llama mientras 'dev->attach_lock' est\u00e1 bloqueado en modo escritura, lo cual no era el caso anteriormente, pero eso no importa.\n\nGracias a Jens Axboe por diagnosticar el problema y codesarrollar este parche."}], "id": "CVE-2025-38687", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-04T16:15:36.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: comedi: fix race between polling and detaching", "id": "2393181", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393181"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38687", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38687\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38687\nhttps://lore.kernel.org/linux-cve-announce/2025090448-CVE-2025-38687-564a@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-05T14:02:40.748857+00:00", "updated": "2025-09-05T14:02:40.748908+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}