CVE-2025-39685CWE-125

CVE-2025-39685

High · published September 5, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
5.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

comedi: pcl726: Prevent invalid irq number

The reproducer passed in an irq number(0x80008000) that was too large,

which triggered the oob.

Added an interrupt number check to prevent users from passing in an irq

number that was too large.

If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid

because it shifts a 1-bit into the sign bit (which is UB in C).

Possible solutions include reducing the upper bound on the

`it->options[1]` value to 30 or lower, or using `1U << it->options[1]`.

The old code would just not attempt to request the IRQ if the

`options[1]` value were invalid. And it would still configure the

device without interrupts even if the call to `request_irq` returned an

error. So it would be better to combine this test with the test below.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00165 · 5.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-09-05T22:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 3.13, < 5.15.1905.15.190
linux/linux_kernel≥ 5.16, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.446.12.44
linux/linux_kernel≥ 6.13, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (8)
EPSS history
Timeline
  • 05 SEP 17:20Z
    comedi: pcl726: Prevent invalid irq number
    cvelistv5