CVE-2026-31748: comedi: me_daq: Fix potential overrun of firmware buffer
In the Linux kernel, the following vulnerability has been resolved:
comedi: medaq: Fix potential overrun of firmware buffer
me2600xilinxdownload() loads the firmware that was requested by requestfirmware(). It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable filelength and reads the data stream contents of length filelength from offset 16 onwards. Although it checks that the supplied firmware is at least 16 bytes long, it does not check that it is long enough to contain the data stream.
Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return -EINVAL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In me2600_xilinx_download(), validate that the supplied firmware length is sufficient for the 16-byte header plus the data stream length read from the first 4 bytes before reading file_length bytes from offset 16; on failure, log an error and return -EINVAL.
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The vulnerability is rated with local attack vector and low privileges required. No user interaction is required.
What condition in a firmware file triggers the overrun risk?
The file is at least 16 bytes long but declares a data-stream length in its first four bytes that exceeds the bytes actually available from offset 16 onward. The vulnerable code trusts that declared length and can read beyond the firmware buffer.
How does the resolved code handle malformed firmware?
It verifies that the supplied firmware is large enough for both the 16-byte header and the declared data stream. If the check fails, it logs an error and returns -EINVAL.