In the Linux kernel, the following vulnerability has been resolved:
comedi: Fail COMEDIINSNLIST ioctl if ninsns is too large
The handling of the COMEDI_INSNLIST ioctl allocates a kernel buffer to
hold the array of struct comedi_insn, getting the length from the
n_insns member of the struct comedi_insnlist supplied by the user.
The allocation will fail with a WARNING and a stack dump if it is too
large.
Avoid that by failing with an -EINVAL error if the supplied n_insns
value is unreasonable.
Define the limit on the n_insns value in the MAX_INSNS macro. Set
this to the same value as MAX_SAMPLES (65536), which is the maximum
allowed sum of the values of the member n in the array of struct
comedi_insn, and sensible comedi instructions will have an n of at
least 1.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38481.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38481.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-35a5231c",
"digest": {
"length": 703.0,
"function_hash": "54228153440498613394218061231334767203"
},
"signature_type": "Function",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "compat_insnlist"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-4d167300",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250084368284710790406806550503851868363",
"282766432883905258201451069004091919630",
"44920158663535986996595745300565331491",
"158404017557381302874717959292955917807",
"249254770200217024300083387997306854865",
"94886624670636247945353767013774200613",
"152325123724031571207758007022494472448",
"206332651888876200503781608815082859436",
"60535897269242853526873253646870475347",
"12052173193207731243161423072639506757"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/comedi/comedi_fops.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-6366b75e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250084368284710790406806550503851868363",
"282766432883905258201451069004091919630",
"44920158663535986996595745300565331491",
"158404017557381302874717959292955917807",
"249254770200217024300083387997306854865",
"94886624670636247945353767013774200613",
"152325123724031571207758007022494472448",
"206332651888876200503781608815082859436",
"60535897269242853526873253646870475347",
"12052173193207731243161423072639506757"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/comedi/comedi_fops.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-7d30ad9a",
"digest": {
"length": 703.0,
"function_hash": "54228153440498613394218061231334767203"
},
"signature_type": "Function",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "compat_insnlist"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-cdffda83",
"digest": {
"length": 3098.0,
"function_hash": "62660849855065595756777087534953127479"
},
"signature_type": "Function",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_unlocked_ioctl"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2025-38481-e4c8b2af",
"digest": {
"length": 3098.0,
"function_hash": "62660849855065595756777087534953127479"
},
"signature_type": "Function",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_unlocked_ioctl"
}
}
]