CVE-2025-39685: comedi: pcl726: Prevent invalid irq number
comedi: pcl726: Prevent invalid irq number
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In comedi pcl726, reject `it->options[1]` IRQ values above 30 before shifting, or use `1U << it->options[1]` to avoid shifting a 1-bit into the sign bit.
- Compensating control
Do not configure the device without interrupts when `request_irq` returns an error; treat the IRQ request failure as a failure of device configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39685?
CVE-2025-39685 has been classified as a moderate-severity vulnerability due to the potential for out-of-bounds access.
How do I fix CVE-2025-39685?
To fix CVE-2025-39685, update your Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2025-39685?
CVE-2025-39685 affects certain versions of the Linux kernel that utilize the comedi subsystem.
What does CVE-2025-39685 exploit?
CVE-2025-39685 exploits the ability to pass an excessively large IRQ number, causing an out-of-bounds access.
Is CVE-2025-39685 being actively exploited in the wild?
As of now, there is no publicly available information indicating that CVE-2025-39685 is being actively exploited.