In the Linux kernel, the following vulnerability has been resolved:
comedi: fix divide-by-zero in comedibufmunge()
The comedibufmunge() function performs a modulo operation
async->munge_chan %= async->cmd.chanlist_len without first
checking if chanlistlen is zero. If a user program submits a command with
chanlistlen set to zero, this causes a divide-by-zero error when the device
processes data in the interrupt handler path.
Add a check for zero chanlistlen at the beginning of the function, similar to the existing checks for !map and CMDFRAWDATA flag. When chanlistlen is zero, update mungecount and return early, indicating the data was handled without munging.
This prevents potential kernel panics from malformed user commands.
[
{
"digest": {
"length": 798.0,
"function_hash": "140393956601392866620276522796421705503"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4bb5d1bc2f238461bcbe5303eb500466690bb2c",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-18ec3dc6",
"signature_type": "Function"
},
{
"digest": {
"length": 806.0,
"function_hash": "75442307196342662342165959976637459975"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ffea48c69cb2b96a281cb7e5e42d706996631db",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/staging/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-19922e8a",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"120791249687461568090804355583093984577",
"259756446748416523542471993161551452410"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c",
"target": {
"file": "drivers/staging/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-19b6b61f",
"signature_type": "Line"
},
{
"digest": {
"length": 909.0,
"function_hash": "132494439836481969323240957093077313774"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55520f65fd447e04099a2c44185453c18ea73b7e",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-2f8a6de9",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"120791249687461568090804355583093984577",
"259756446748416523542471993161551452410"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ffea48c69cb2b96a281cb7e5e42d706996631db",
"target": {
"file": "drivers/staging/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-30c69fc5",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db19822512396be1a3e1e20c16c97270285ba1a",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-3e9bd9c4",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4854eff25efb06d0d84c13e7129bbdba4125f8c",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-4e6814b0",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"81294429962901808435747476666211852880",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b318ba81dda2ee7b603f4f6c55e78ec3e95974",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-ae56681d",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4bb5d1bc2f238461bcbe5303eb500466690bb2c",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-b9dcf442",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"81294429962901808435747476666211852880",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55520f65fd447e04099a2c44185453c18ea73b7e",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-ba941a7a",
"signature_type": "Line"
},
{
"digest": {
"length": 798.0,
"function_hash": "140393956601392866620276522796421705503"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db19822512396be1a3e1e20c16c97270285ba1a",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-bd7b1ed8",
"signature_type": "Function"
},
{
"digest": {
"length": 806.0,
"function_hash": "75442307196342662342165959976637459975"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/staging/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-bf8a94e5",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"68156364547539482861364112780446537583",
"185519871308213119777770979335498019650",
"215714103929962255280705843643535367159",
"15120801810383916901973443186468533224"
],
"threshold": 0.9
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2670932f2465793fea1ef073e40883e8390fa4d9",
"target": {
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-cf1b2150",
"signature_type": "Line"
},
{
"digest": {
"length": 798.0,
"function_hash": "140393956601392866620276522796421705503"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d4854eff25efb06d0d84c13e7129bbdba4125f8c",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-cf946d06",
"signature_type": "Function"
},
{
"digest": {
"length": 798.0,
"function_hash": "140393956601392866620276522796421705503"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2670932f2465793fea1ef073e40883e8390fa4d9",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-d1939f3e",
"signature_type": "Function"
},
{
"digest": {
"length": 909.0,
"function_hash": "132494439836481969323240957093077313774"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b318ba81dda2ee7b603f4f6c55e78ec3e95974",
"target": {
"function": "comedi_buf_munge",
"file": "drivers/comedi/comedi_buf.c"
},
"id": "CVE-2025-40106-d7f3711a",
"signature_type": "Function"
}
]