CVE-2025-38481

comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

published July 28, 2025

CVSS
—
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to

hold the array of `struct comedi_insn`, getting the length from the

`n_insns` member of the `struct comedi_insnlist` supplied by the user.

The allocation will fail with a WARNING and a stack dump if it is too

large.

Avoid that by failing with an `-EINVAL` error if the supplied `n_insns`

value is unreasonable.

Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set

this to the same value as `MAX_SAMPLES` (65536), which is the maximum

allowed sum of the values of the member `n` in the array of `struct

comedi_insn`, and sensible comedi instructions will have an `n` of at

least 1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Published
2025-07-28T11:21Z
EPSS history
Timeline
  • 28 JUL 11:21Z
    comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
    cvelistv5