CVE-2025-38478: comedi: Fix initialization of data for instructions that write to subdevice

Published Jul 28, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fix initialization of data for instructions that write to subdevice

Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn->n elements in some cases. The doinsnioctl() and doinsnlistioctl() functions allocate at least MINSAMPLES (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first insn->n data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first MINSAMPLES elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For doinsnlistioctl(), the same data buffer elements are used for handling a list of instructions, so ensure the first MINSAMPLES elements are initialized for each instruction that writes to the subdevice.

Affected Software

16 affected componentsFixes available
Linux Kernel
Linux Linux kernel>=2.6.29<5.4.297
Linux Linux kernel>=5.5<5.10.241
Linux Linux kernel>=5.11<5.15.190
Linux Linux kernel>=5.16<6.1.147
Linux Linux kernel>=6.2<6.6.100
Linux Linux kernel>=6.7<6.12.40
Linux Linux kernel>=6.13<6.15.8
Linux Linux kernel=6.16-rc1
Linux Linux kernel=6.16-rc2
Linux Linux kernel=6.16-rc3
Linux Linux kernel=6.16-rc4
Linux Linux kernel=6.16-rc5
Linux Linux kernel=6.16-rc6
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
  2. Compensating control

    For Comedi instructions that write to a subdevice, initialize the first MIN_SAMPLES (16) data elements before invoking the instruction handler, filling elements not copied from user space with 0. In do_insnlist_ioctl(), perform this initialization for each instruction that writes to the subdevice.

Event History

Jul 28, 2025
CVE Published
via MITRE·11:21 AM
Data Sourced
via MITRE·11:21 AM
DescriptionSeverity
Data Sourced
via NVD·12:15 PM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2025-38478?

CVE-2025-38478 has a medium severity rating due to potential data corruption issues.

2

How do I fix CVE-2025-38478?

To fix CVE-2025-38478, users should update their Linux kernel to the latest stable version where the vulnerability has been resolved.

3

Who is affected by CVE-2025-38478?

CVE-2025-38478 affects users of certain versions of the Linux kernel that utilize Comedi subdevice instruction handlers.

4

What types of attacks can exploit CVE-2025-38478?

Exploiting CVE-2025-38478 could allow an attacker to potentially corrupt data managed by specific Comedi subdevice instruction handlers.

5

Is CVE-2025-38478 still an active threat?

As of the latest updates, CVE-2025-38478 should no longer pose an active threat if systems are patched accordingly.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203