Linux Kernel Vulnerability in Comedi Digital Input/Output Subdevices

CVE-2025-38480

What is CVE-2025-38480?

An issue has been identified in the Linux kernel that affects Comedi digital input/output subdevices whereby uninitialized data could potentially be written or read, leading to an incorrect value being processed. The vulnerability occurs because the function handling INSN_WRITE does not properly validate or check the size of its input, allowing erroneous or uninitialized data to propagate. A fix was implemented to ensure that if the instruction count is zero, the method exits early, thus mitigating the risk of utilizing invalid data and maintaining the integrity of the digital channels.

References