CVE-2025-38478

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38478
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38478.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38478
Downstream
Related
Published
2025-07-28T11:21:44.210Z
Modified
2026-03-12T02:15:40.667561Z
Summary
comedi: Fix initialization of data for instructions that write to subdevice
Details

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fix initialization of data for instructions that write to subdevice

Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first insn->n elements in some cases. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate at least MIN_SAMPLES (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first insn->n data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first MIN_SAMPLES elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For do_insnlist_ioctl(), the same data buffer elements are used for handling a list of instructions, so ensure the first MIN_SAMPLES elements are initialized for each instruction that writes to the subdevice.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38478.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ed9eccbe8970f6eedc1b978c157caf1251a896d4
Fixed
6f38c6380c3b38a05032b8881e41137385a6ce02
Fixed
13e4d9038a1e869445a996a3f604a84ef52fe8f4
Fixed
020eed5681d0f9bced73970368078a92d6cfaa9c
Fixed
d3436638738ace8f101af7bdee2eae1bc38e9b29
Fixed
673ee92bd2d31055bca98a1d96b653f5284289c4
Fixed
c42116dc70af6664526f7aa82cf937824ab42649
Fixed
fe8713fb4e4e82a4f91910d9a41bf0613e69a0b9
Fixed
46d8c744136ce2454aa4c35c138cc06817f92b8e

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38478.json"