In the Linux kernel, the following vulnerability has been resolved:
comedi: Make insnrwemulate_bits() do insn->n samples
The insn_rw_emulate_bits() function is used as a default handler for
INSN_READ instructions for subdevices that have a handler for
INSN_BITS but not for INSN_READ. Similarly, it is used as a default
handler for INSN_WRITE instructions for subdevices that have a handler
for INSN_BITS but not for INSN_WRITE. It works by emulating the
INSN_READ or INSN_WRITE instruction handling with a constructed
INSN_BITS instruction. However, INSN_READ and INSN_WRITE
instructions are supposed to be able read or write multiple samples,
indicated by the insn->n value, but insn_rw_emulate_bits() currently
only handles a single sample. For INSN_READ, the comedi core will
copy insn->n samples back to user-space. (That triggered KASAN
kernel-infoleak errors when insn->n was greater than 1, but that is
being fixed more generally elsewhere in the comedi core.)
Make insn_rw_emulate_bits() either handle insn->n samples, or return
an error, to conform to the general expectation for INSN_READ and
INSN_WRITE handlers.
[
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@842f307a1d115b24f2bcb2415c4e344f11f55930",
"signature_version": "v1",
"id": "CVE-2025-39686-09d92b4a",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab77e85bd3bc006ef40738f26f446a660813da44",
"signature_version": "v1",
"id": "CVE-2025-39686-1e8644f1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7afba9221f70d4cbce0f417c558879cba0eb5e66",
"signature_version": "v1",
"id": "CVE-2025-39686-36dfbd90",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92352ed2f9ac422181e381c2430c2d0dfb46faa0",
"signature_version": "v1",
"id": "CVE-2025-39686-3851d001",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92352ed2f9ac422181e381c2430c2d0dfb46faa0",
"signature_version": "v1",
"id": "CVE-2025-39686-50a1a66c",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7afba9221f70d4cbce0f417c558879cba0eb5e66",
"signature_version": "v1",
"id": "CVE-2025-39686-71f5c867",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc0a2f142d655700db43de90cb6abf141b73d908",
"signature_version": "v1",
"id": "CVE-2025-39686-97723cc8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab77e85bd3bc006ef40738f26f446a660813da44",
"signature_version": "v1",
"id": "CVE-2025-39686-9e0ebd57",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@842f307a1d115b24f2bcb2415c4e344f11f55930",
"signature_version": "v1",
"id": "CVE-2025-39686-a89657fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc0a2f142d655700db43de90cb6abf141b73d908",
"signature_version": "v1",
"id": "CVE-2025-39686-b1df0703",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8bc1f07bcb31b8636420e03d1f9c3df6219a2b",
"signature_version": "v1",
"id": "CVE-2025-39686-b5c6403d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"242289940729852547937491565992287177813",
"219698545750350589924527982144664758181",
"24033393124213329850664484422806254860",
"200872749507661582447028478782527956084",
"71971625456953579332156233877344004422",
"152882143999761318008190443125803332038",
"93180535152498166655794260944411368433",
"228421847581036822884503824065932860027",
"80304766398787660663561360452779866043",
"212232652142734085504877070023428721626",
"82121932212694772439720293993783259203",
"334140705344211933511221446801881847734",
"228255756291670439480900432949381428038",
"340130441422911814039113801125772286224",
"191477824905729496102402755186144481349",
"76471681239303462886318495257301374045",
"201516144892225556997201071934244309984",
"77284568398818489815246940345955213942",
"139450689885311728160906636187904781335"
]
}
},
{
"deprecated": false,
"target": {
"file": "drivers/comedi/drivers.c",
"function": "insn_rw_emulate_bits"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8bc1f07bcb31b8636420e03d1f9c3df6219a2b",
"signature_version": "v1",
"id": "CVE-2025-39686-cadd7da2",
"digest": {
"function_hash": "235580711128090073573299279786442501410",
"length": 845.0
}
}
]