{"id":"CVE-2025-38478","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements be…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements be…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-908"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.29, < 5.4.297","linux_kernel >= 5.5, < 5.10.241","linux_kernel >= 5.11, < 5.15.190","linux_kernel >= 5.16, < 6.1.147","linux_kernel >= 6.2, < 6.6.100","linux_kernel >= 6.7, < 6.12.40","linux_kernel >= 6.13, < 6.15.8","linux_kernel = 6.16","debian_linux = 11.0"],"patched":["linux_kernel 6.15.8"],"published":"2025-07-28","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:42.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38478","references":[{"url":"https://git.kernel.org/stable/c/020eed5681d0f9bced73970368078a92d6cfaa9c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/13e4d9038a1e869445a996a3f604a84ef52fe8f4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/46d8c744136ce2454aa4c35c138cc06817f92b8e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/673ee92bd2d31055bca98a1d96b653f5284289c4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f38c6380c3b38a05032b8881e41137385a6ce02","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c42116dc70af6664526f7aa82cf937824ab42649","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3436638738ace8f101af7bdee2eae1bc38e9b29","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"epss":0.00179,"epssPercentile":0.07396,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:50:50.290792Z"},"ingestedAt":"2026-10-15T22:48:25.509Z","slug":"CVE-2025-38478","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Fix initialization of data for instructions that write to subdevice\n\nSome Comedi subdevice instruction handlers are known to access\ninstruction data elements beyond the first `insn->n` elements in some\ncases.  The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions\nallocate at least `MIN_SAMPLES` (16) data elements to deal with this,\nbut they do not initialize all of that.  For Comedi instruction codes\nthat write to the subdevice, the first `insn->n` data elements are\ncopied from user-space, but the remaining elements are left\nuninitialized.  That could be a problem if the subdevice instruction\nhandler reads the uninitialized data.  Ensure that the first\n`MIN_SAMPLES` elements are initialized before calling these instruction\nhandlers, filling the uncopied elements with 0.  For\n`do_insnlist_ioctl()`, the same data buffer elements are used for\nhandling a list of instructions, so ensure the first `MIN_SAMPLES`\nelements are initialized for each instruction that writes to the\nsubdevice.\n\n## Affected\n\n- `linux_kernel >= 2.6.29, < 5.4.297`\n- `linux_kernel >= 5.5, < 5.10.241`\n- `linux_kernel >= 5.11, < 5.15.190`\n- `linux_kernel >= 5.16, < 6.1.147`\n- `linux_kernel >= 6.2, < 6.6.100`\n- `linux_kernel >= 6.7, < 6.12.40`\n- `linux_kernel >= 6.13, < 6.15.8`\n- `linux_kernel = 6.16`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.15.8`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}