Description
In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid */ if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
729988507680b2ce934bce61d9ce0ea7b235914c to < 539bdff832adac9ea653859fa0b6bc62e743329caffected729988507680b2ce934bce61d9ce0ea7b235914c to < d1291c69f46d6572b2cf75960dd8975d7ab2176baffected729988507680b2ce934bce61d9ce0ea7b235914c to < b3c95fa508e5dc3da60520eea92a5241095ceef1affected729988507680b2ce934bce61d9ce0ea7b235914c to < 65c03e6fc524eb2868abedffd8a4613d78abc288affected729988507680b2ce934bce61d9ce0ea7b235914c to < adb7df8a8f9d788423e161b779764527dd3ec2d0affected729988507680b2ce934bce61d9ce0ea7b235914c to < 076b13ee60eb01ed0d140ef261f95534562a3077affected729988507680b2ce934bce61d9ce0ea7b235914c to < f211572818ed5bec2b3f5d4e0719ef8699b3c269affected729988507680b2ce934bce61d9ce0ea7b235914c to < ed93c6f68a3be06e4e0c331c6e751f462dee3932affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.147 to ≤ 6.1.*unaffected6.6.100 to ≤ 6.6.*unaffected6.12.40 to ≤ 6.12.*unaffected6.15.8 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/539bdff832adac9ea653859fa0b6bc62e743329c ↗
- https://git.kernel.org/stable/c/d1291c69f46d6572b2cf75960dd8975d7ab2176b ↗
- https://git.kernel.org/stable/c/b3c95fa508e5dc3da60520eea92a5241095ceef1 ↗
- https://git.kernel.org/stable/c/65c03e6fc524eb2868abedffd8a4613d78abc288 ↗
- https://git.kernel.org/stable/c/adb7df8a8f9d788423e161b779764527dd3ec2d0 ↗
- https://git.kernel.org/stable/c/076b13ee60eb01ed0d140ef261f95534562a3077 ↗
- https://git.kernel.org/stable/c/f211572818ed5bec2b3f5d4e0719ef8699b3c269 ↗
- https://git.kernel.org/stable/c/ed93c6f68a3be06e4e0c331c6e751f462dee3932 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗