Description
In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to < 6f38c6380c3b38a05032b8881e41137385a6ce02affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 13e4d9038a1e869445a996a3f604a84ef52fe8f4affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 020eed5681d0f9bced73970368078a92d6cfaa9caffecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < d3436638738ace8f101af7bdee2eae1bc38e9b29affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 673ee92bd2d31055bca98a1d96b653f5284289c4affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < c42116dc70af6664526f7aa82cf937824ab42649affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9affecteded9eccbe8970f6eedc1b978c157caf1251a896d4 to < 46d8c744136ce2454aa4c35c138cc06817f92b8eaffected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.147 to ≤ 6.1.*unaffected6.6.100 to ≤ 6.6.*unaffected6.12.40 to ≤ 6.12.*unaffected6.15.8 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02 ↗
- https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4 ↗
- https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c ↗
- https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29 ↗
- https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4 ↗
- https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649 ↗
- https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9 ↗
- https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗