In the Linux kernel, the following vulnerability has been resolved:
comedi: Fix use of uninitialized data in insnrwemulate_bits()
For Comedi INSN_READ and INSN_WRITE instructions on "digital"
subdevices (subdevice types COMEDI_SUBD_DI, COMEDI_SUBD_DO, and
COMEDI_SUBD_DIO), it is common for the subdevice driver not to have
insn_read and insn_write handler functions, but to have an
insn_bits handler function for handling Comedi INSN_BITS
instructions. In that case, the subdevice's insn_read and/or
insn_write function handler pointers are set to point to the
insn_rw_emulate_bits() function by __comedi_device_postconfig().
For INSN_WRITE, insn_rw_emulate_bits() currently assumes that the
supplied data[0] value is a valid copy from user memory. It will at
least exist because do_insnlist_ioctl() and do_insn_ioctl() in
"comedi_fops.c" ensure at lease MIN_SAMPLES (16) elements are
allocated. However, if insn->n is 0 (which is allowable for
INSN_READ and INSN_WRITE instructions, then data[0] may contain
uninitialized data, and certainly contains invalid data, possibly from a
different instruction in the array of instructions handled by
do_insnlist_ioctl(). This will result in an incorrect value being
written to the digital output channel (or to the digital input/output
channel if configured as an output), and may be reflected in the
internal saved state of the channel.
Fix it by returning 0 early if insn->n is 0, before reaching the code
that accesses data[0]. Previously, the function always returned 1 on
success, but it is supposed to be the number of data samples actually
read or written up to insn->n, which is 0 in this case.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3050d197d6bc9ef128944a70210f42d2430b3000",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-0bdada48"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53570e62b5b28bdb56bb563190227f8307817a5",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-1c9f8e1b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ab55ffaaf75d0c7b68e332c1cdcc1b0e0044870",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-24fae49f"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10f9024a8c824a41827fff1fefefb314c98e2c88",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-25e00d6d"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c2981bf30401adfcdbfece4ab6f411f7c5875a1",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-4f5b2d82"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10f9024a8c824a41827fff1fefefb314c98e2c88",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-603501a7"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3050d197d6bc9ef128944a70210f42d2430b3000",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-7676e1e4"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2af1e7d389c2619219171d23f5b96dbcbb7f9656",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-934799ef"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c2981bf30401adfcdbfece4ab6f411f7c5875a1",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-99cb66f6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/staging/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16256d7efcf7acc9f39abe21522c4c6b77f67c00",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-9f4dc766"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c53570e62b5b28bdb56bb563190227f8307817a5",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-b30b10a6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ab55ffaaf75d0c7b68e332c1cdcc1b0e0044870",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-bc9fd422"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/staging/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16256d7efcf7acc9f39abe21522c4c6b77f67c00",
"digest": {
"length": 811.0,
"function_hash": "333012640877438949619725707138803589140"
},
"id": "CVE-2025-38480-cb47143c"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2af1e7d389c2619219171d23f5b96dbcbb7f9656",
"digest": {
"line_hashes": [
"273351334717549436619647009357053244763",
"18844279853186695474381408581303092232",
"123476067869109046417384188633956857538"
],
"threshold": 0.9
},
"id": "CVE-2025-38480-e0bbff8e"
}
]