CVE-2026-43340

comedi: Reinit dev->spinlock between attachments to low-level drivers

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

comedi: Reinit dev->spinlock between attachments to low-level drivers

`struct comedi_device` is the main controlling structure for a COMEDI

device created by the COMEDI subsystem. It contains a member `spinlock`

containing a spin-lock that is initialized by the COMEDI subsystem, but

is reserved for use by a low-level driver attached to the COMEDI device

(at least since commit 25436dc9d84f ("Staging: comedi: remove RT

code")).

Some COMEDI devices (those created on initialization of the COMEDI

subsystem when the "comedi.comedi_num_legacy_minors" parameter is

non-zero) can be attached to different low-level drivers over their

lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in

inconsistent lock states being reported when there is a mismatch in the

spin-lock locking levels used by each low-level driver to which the

COMEDI device has been attached. Fix it by reinitializing

`dev->spinlock` before calling the low-level driver's `attach` function

pointer if `CONFIG_LOCKDEP` is enabled.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.2th percentile
Published
2026-05-08T13:37Z
EPSS history
Timeline
  • 08 MAY 13:37Z
    comedi: Reinit dev->spinlock between attachments to low-level drivers
    cvelistv5