In the Linux kernel, the following vulnerability has been resolved:
comedi: Fix use of uninitialized memory in doinsnioctl() and doinsnlistioctl()
syzbot reports a KMSAN kernel-infoleak in do_insn_ioctl(). A kernel
buffer is allocated to hold insn->n samples (each of which is an
unsigned int). For some instruction types, insn->n samples are
copied back to user-space, unless an error code is being returned. The
problem is that not all the instruction handlers that need to return
data to userspace fill in the whole insn->n samples, so that there is
an information leak. There is a similar syzbot report for
do_insnlist_ioctl(), although it does not have a reproducer for it at
the time of writing.
One culprit is insn_rw_emulate_bits() which is used as the handler for
INSN_READ or INSN_WRITE instructions for subdevices that do not have
a specific handler for that instruction, but do have an INSN_BITS
handler. For INSN_READ it only fills in at most 1 sample, so if
insn->n is greater than 1, the remaining insn->n - 1 samples copied
to userspace will be uninitialized kernel data.
Another culprit is vm80xx_ai_insn_read() in the "vm80xx" driver. It
never returns an error, even if it fails to fill the buffer.
Fix it in do_insn_ioctl() and do_insnlist_ioctl() by making sure
that uninitialized parts of the allocated buffer are zeroed before
handling each instruction.
Thanks to Arnaud Lecomte for their fix to do_insn_ioctl(). That fix
replaced the call to kmalloc_array() with kcalloc(), but it is not
always necessary to clear the whole buffer.
[
{
"id": "CVE-2025-39684-148e3aa6",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@868a1b68dcd9f2805bb86aa64862402f785d8c4a",
"digest": {
"length": 1408.0,
"function_hash": "250712170371135647840817299616575891834"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-66f75857",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@868a1b68dcd9f2805bb86aa64862402f785d8c4a",
"digest": {
"line_hashes": [
"163097848301077623058414471779829975437",
"263789112164072464346312877908883720191",
"263098713664916716551551499196590875192",
"136689862210028744041743821948100185306",
"252295811414006312701154923228830534567",
"315711582814888522702557533101683136023",
"210293854242645472156755108497614760371",
"99138746882552117573008796438633673235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-39684-67c5f220",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aecf0d557ddd95ce68193a5ee1dc4c87415ff08a",
"digest": {
"line_hashes": [
"163097848301077623058414471779829975437",
"263789112164072464346312877908883720191",
"263098713664916716551551499196590875192",
"136689862210028744041743821948100185306",
"252295811414006312701154923228830534567",
"315711582814888522702557533101683136023",
"210293854242645472156755108497614760371",
"99138746882552117573008796438633673235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-39684-8c4db10e",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3b0c9ec54736f3b8118f93a473d22e11ee65743",
"digest": {
"length": 1408.0,
"function_hash": "250712170371135647840817299616575891834"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-ac4ebe5a",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d84f6e77ebe3359394df32ecd97e0d76a25283dc",
"digest": {
"line_hashes": [
"163097848301077623058414471779829975437",
"263789112164072464346312877908883720191",
"263098713664916716551551499196590875192",
"136689862210028744041743821948100185306",
"252295811414006312701154923228830534567",
"315711582814888522702557533101683136023",
"210293854242645472156755108497614760371",
"99138746882552117573008796438633673235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-39684-b46abf74",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3b0c9ec54736f3b8118f93a473d22e11ee65743",
"digest": {
"line_hashes": [
"163097848301077623058414471779829975437",
"263789112164072464346312877908883720191",
"263098713664916716551551499196590875192",
"136689862210028744041743821948100185306",
"252295811414006312701154923228830534567",
"315711582814888522702557533101683136023",
"210293854242645472156755108497614760371",
"99138746882552117573008796438633673235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-39684-b487efbc",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insn_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aecf0d557ddd95ce68193a5ee1dc4c87415ff08a",
"digest": {
"length": 1008.0,
"function_hash": "234671158891044737917467914406777928503"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-ba348ce7",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insn_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d84f6e77ebe3359394df32ecd97e0d76a25283dc",
"digest": {
"length": 1008.0,
"function_hash": "234671158891044737917467914406777928503"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-c079d67a",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insn_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3b0c9ec54736f3b8118f93a473d22e11ee65743",
"digest": {
"length": 1008.0,
"function_hash": "234671158891044737917467914406777928503"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-c243497c",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4a7c18799c7fe999fa56c5cf276e13866b8c1a",
"digest": {
"length": 1408.0,
"function_hash": "250712170371135647840817299616575891834"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-d4d19b09",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aecf0d557ddd95ce68193a5ee1dc4c87415ff08a",
"digest": {
"length": 1408.0,
"function_hash": "250712170371135647840817299616575891834"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-de080d73",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insn_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@868a1b68dcd9f2805bb86aa64862402f785d8c4a",
"digest": {
"length": 1008.0,
"function_hash": "234671158891044737917467914406777928503"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-e24d3507",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d84f6e77ebe3359394df32ecd97e0d76a25283dc",
"digest": {
"length": 1408.0,
"function_hash": "250712170371135647840817299616575891834"
},
"deprecated": false
},
{
"id": "CVE-2025-39684-f0c7612c",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4a7c18799c7fe999fa56c5cf276e13866b8c1a",
"digest": {
"line_hashes": [
"163097848301077623058414471779829975437",
"263789112164072464346312877908883720191",
"263098713664916716551551499196590875192",
"136689862210028744041743821948100185306",
"252295811414006312701154923228830534567",
"315711582814888522702557533101683136023",
"210293854242645472156755108497614760371",
"99138746882552117573008796438633673235"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-39684-ffb86ee4",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "do_insn_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff4a7c18799c7fe999fa56c5cf276e13866b8c1a",
"digest": {
"length": 1008.0,
"function_hash": "234671158891044737917467914406777928503"
},
"deprecated": false
}
]