CVE-2025-38481

comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

State: Published
Severity: Not scored
Published: Jul 28, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large

The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large.

Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable.

Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 454d732dfd0aef7d7aa950c409215ca06d717e93Affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before c68257588e87f45530235701a42496b7e9e56adbAffected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 69dc06b9514522de532e997a21d035cd29b0db44Affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3Affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before c9d3d9667443caafa804cd07940aeaef8e53aa90Affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 992d600f284e719242a434166e86c1999649b71cAffected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before e3b8322cc8081d142ee4c1a43e1d702bdba1ed76Affected ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 08ae4b20f5e82101d77326ecab9089e110f224ccAffected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.4.297 through 5.4.Not affected 5.10.241 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.147 through 6.1.Not affected 6.6.100 through 6.6.Not affected 6.12.40 through 6.12.Not affected 6.15.8 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 454d732dfd0aef7d7aa950c409215ca06d717e93Affected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before c68257588e87f45530235701a42496b7e9e56adbAffected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 69dc06b9514522de532e997a21d035cd29b0db44Affected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3Affected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before c9d3d9667443caafa804cd07940aeaef8e53aa90Affected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 992d600f284e719242a434166e86c1999649b71cAffected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before e3b8322cc8081d142ee4c1a43e1d702bdba1ed76Affected
ed9eccbe8970f6eedc1b978c157caf1251a896d4 to before 08ae4b20f5e82101d77326ecab9089e110f224ccAffected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.4.297 through 5.4.*Not affected
5.10.241 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.147 through 6.1.*Not affected
6.6.100 through 6.6.*Not affected
6.12.40 through 6.12.*Not affected
6.15.8 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.