CVE-2025-38478comedi: Fix initialization of data for instructions that write to subdevice
- 7.8HighCVSS base score
- 0.19%Exploitation in 30 daysEPSS · top 91% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice.
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 15 months later
· 15 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.19% · top 91% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < 6f38c6380c3b38a05032b8881e41137385a6ce02
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < 13e4d9038a1e869445a996a3f604a84ef52fe8f4
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < 020eed5681d0f9bced73970368078a92d6cfaa9c
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < d3436638738ace8f101af7bdee2eae1bc38e9b29
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < 673ee92bd2d31055bca98a1d96b653f5284289c4
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < c42116dc70af6664526f7aa82cf937824ab42649
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9
- affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 – < 46d8c744136ce2454aa4c35c138cc06817f92b8e
- affected 2.6.29
- unaffected < 2.6.29
- unaffected 5.4.297 – ≤ 5.4.*
- unaffected 5.10.241 – ≤ 5.10.*
- unaffected 5.15.190 – ≤ 5.15.*
- unaffected 6.1.147 – ≤ 6.1.*
- unaffected 6.6.100 – ≤ 6.6.*
- unaffected 6.12.40 – ≤ 6.12.*
- unaffected 6.15.8 – ≤ 6.15.*
- unaffected 6.16 – ≤ *
References
References10
- https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02 (opens in a new tab)
- https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4 (opens in a new tab)
- https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c (opens in a new tab)
- https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29 (opens in a new tab)
- https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4 (opens in a new tab)
- https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649 (opens in a new tab)
- https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9 (opens in a new tab)
- https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-22884 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-38478)Record last updated .