CVE-2025-38480: comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
comedi: Fix use of uninitialized data in insnrwemulatebits()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In comedi's insn_rw_emulate_bits(), return 0 immediately when insn->n is 0, before accessing data[0]. This applies to Comedi INSN_READ and INSN_WRITE handling for digital subdevices.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38480?
CVE-2025-38480 has been rated as a moderate severity vulnerability.
How do I fix CVE-2025-38480?
To fix CVE-2025-38480, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2025-38480?
CVE-2025-38480 affects the Linux kernel, specifically impacting digital subdevices associated with Comedi.
What type of vulnerability is CVE-2025-38480?
CVE-2025-38480 is a vulnerability related to the use of uninitialized data in the Comedi module of the Linux kernel.
What are the potential impacts of CVE-2025-38480?
The potential impacts of CVE-2025-38480 include unexpected behavior or crashes in applications using Comedi for digital input/output operations.