Description
In the Linux kernel, the following vulnerability has been resolved: comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ad7a370c8be47247f68f7187cc82f4f25a347116 to < a88692245c315bf8e225f205297a6f4b13d6856aaffectedad7a370c8be47247f68f7187cc82f4f25a347116 to < 5ac7c60439236fb691b8c7987390e2327bbf18faaffectedad7a370c8be47247f68f7187cc82f4f25a347116 to < c593215385f0c0163015cca4512ed3ff42875d19affectedad7a370c8be47247f68f7187cc82f4f25a347116 to < ff30dd3f15f443d2a0085b12ec2cc95d44f35fa7affectedad7a370c8be47247f68f7187cc82f4f25a347116 to < 955e8835855fed8e87f7d8c8075564a1746c1b4caffectedad7a370c8be47247f68f7187cc82f4f25a347116 to < e0f3c0867d7d231c70984f05c97752caacd0dabaaffectedad7a370c8be47247f68f7187cc82f4f25a347116 to < 43ddd82e6a91913cea1c078e782afd8de60c3a53affectedad7a370c8be47247f68f7187cc82f4f25a347116 to < 66acb1586737a22dd7b78abc63213b1bcaa100e4affected
Linux Linux
Default version status: affected
4.0affected0 to < 4.0unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.147 to ≤ 6.1.*unaffected6.6.100 to ≤ 6.6.*unaffected6.12.40 to ≤ 6.12.*unaffected6.15.8 to ≤ 6.15.*unaffected6.16 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a88692245c315bf8e225f205297a6f4b13d6856a ↗
- https://git.kernel.org/stable/c/5ac7c60439236fb691b8c7987390e2327bbf18fa ↗
- https://git.kernel.org/stable/c/c593215385f0c0163015cca4512ed3ff42875d19 ↗
- https://git.kernel.org/stable/c/ff30dd3f15f443d2a0085b12ec2cc95d44f35fa7 ↗
- https://git.kernel.org/stable/c/955e8835855fed8e87f7d8c8075564a1746c1b4c ↗
- https://git.kernel.org/stable/c/e0f3c0867d7d231c70984f05c97752caacd0daba ↗
- https://git.kernel.org/stable/c/43ddd82e6a91913cea1c078e782afd8de60c3a53 ↗
- https://git.kernel.org/stable/c/66acb1586737a22dd7b78abc63213b1bcaa100e4 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗