CVE-2025-38478

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fix initialization of data for instructions that write to subdevice

Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn->n elements in some cases. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate at least MIN_SAMPLES (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first insn->n data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first MIN_SAMPLES elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For do_insnlist_ioctl(), the same data buffer elements are used for handling a list of instructions, so ensure the first MIN_SAMPLES elements are initialized for each instruction that writes to the subdevice.

This vulnerability is rated as Moderate severity because exploitation requires local access to Comedi device interfaces, restricting the attack vector and limiting potential impact primarily to a local denial of service. The Comedi subsystem provides drivers for specialized data acquisition hardware and is rarely utilized in standard enterprise server environments. On typical Red Hat Enterprise Linux deployments, the required kernel modules are not loaded by default, substantially reducing exposure for standard systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.