Description
In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid for "enhanced" mode */ if ((1 << it->options[1]) & 0x8cec) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
79e5e6addbb18bf56075f0ff552094a28636dd03 to < a15e9c175f783298c4ee48146be6841335400406affected79e5e6addbb18bf56075f0ff552094a28636dd03 to < de8da1063cce9234d55c8270d9bdf4cf84411c80affected79e5e6addbb18bf56075f0ff552094a28636dd03 to < 73f34d609397805c20d6b2ef5c07a4cbf7c4d63aaffected79e5e6addbb18bf56075f0ff552094a28636dd03 to < a18a42e77545afcacd6a2b8d9fc16191b87454dfaffected79e5e6addbb18bf56075f0ff552094a28636dd03 to < 8a3637027ceeba4ca5e500b23cb7d24c25592513affected79e5e6addbb18bf56075f0ff552094a28636dd03 to < 3eab654f5d199ecd45403c6588cda63e491fcfcaaffected79e5e6addbb18bf56075f0ff552094a28636dd03 to < 4a3c18cde02e35aba87e0ad5672b3e1c72dda5a4affected79e5e6addbb18bf56075f0ff552094a28636dd03 to < 70f2b28b5243df557f51c054c20058ae207baaacaffected
Linux Linux
Default version status: affected
3.15affected0 to < 3.15unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.147 to ≤ 6.1.*unaffected6.6.100 to ≤ 6.6.*unaffected6.12.40 to ≤ 6.12.*unaffected6.15.8 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a15e9c175f783298c4ee48146be6841335400406 ↗
- https://git.kernel.org/stable/c/de8da1063cce9234d55c8270d9bdf4cf84411c80 ↗
- https://git.kernel.org/stable/c/73f34d609397805c20d6b2ef5c07a4cbf7c4d63a ↗
- https://git.kernel.org/stable/c/a18a42e77545afcacd6a2b8d9fc16191b87454df ↗
- https://git.kernel.org/stable/c/8a3637027ceeba4ca5e500b23cb7d24c25592513 ↗
- https://git.kernel.org/stable/c/3eab654f5d199ecd45403c6588cda63e491fcfca ↗
- https://git.kernel.org/stable/c/4a3c18cde02e35aba87e0ad5672b3e1c72dda5a4 ↗
- https://git.kernel.org/stable/c/70f2b28b5243df557f51c054c20058ae207baaac ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗