In the Linux kernel, the following vulnerability has been resolved:
comedi: Fail COMEDIINSNLIST ioctl if ninsns is too large
The handling of the COMEDI_INSNLIST ioctl allocates a kernel buffer to
hold the array of struct comedi_insn, getting the length from the
n_insns member of the struct comedi_insnlist supplied by the user.
The allocation will fail with a WARNING and a stack dump if it is too
large.
Avoid that by failing with an -EINVAL error if the supplied n_insns
value is unreasonable.
Define the limit on the n_insns value in the MAX_INSNS macro. Set
this to the same value as MAX_SAMPLES (65536), which is the maximum
allowed sum of the values of the member n in the array of struct
comedi_insn, and sensible comedi instructions will have an n of at
least 1.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9d3d9667443caafa804cd07940aeaef8e53aa90",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "54228153440498613394218061231334767203",
"length": 703.0
},
"target": {
"function": "compat_insnlist",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-0a9224ed"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454d732dfd0aef7d7aa950c409215ca06d717e93",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "141884899801033105394299091718896254579",
"length": 1787.0
},
"target": {
"function": "do_insnlist_ioctl",
"file": "drivers/staging/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-247d0cf8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454d732dfd0aef7d7aa950c409215ca06d717e93",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"262312309905296296110456609679371092283",
"338954788604224267999450235977617207491",
"314798775993896184392018378457374807146"
]
},
"target": {
"file": "drivers/staging/comedi/comedi_compat32.c"
},
"id": "CVE-2025-38481-32f2b111"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "54228153440498613394218061231334767203",
"length": 703.0
},
"target": {
"function": "compat_insnlist",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-35a5231c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ae4b20f5e82101d77326ecab9089e110f224cc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "62660849855065595756777087534953127479",
"length": 3098.0
},
"target": {
"function": "comedi_unlocked_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-390dbb18"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250084368284710790406806550503851868363",
"282766432883905258201451069004091919630",
"44920158663535986996595745300565331491",
"158404017557381302874717959292955917807",
"249254770200217024300083387997306854865",
"94886624670636247945353767013774200613",
"152325123724031571207758007022494472448",
"206332651888876200503781608815082859436",
"60535897269242853526873253646870475347",
"12052173193207731243161423072639506757"
]
},
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-6366b75e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9d3d9667443caafa804cd07940aeaef8e53aa90",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "62660849855065595756777087534953127479",
"length": 3098.0
},
"target": {
"function": "comedi_unlocked_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-739bfccb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9d3d9667443caafa804cd07940aeaef8e53aa90",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250084368284710790406806550503851868363",
"282766432883905258201451069004091919630",
"44920158663535986996595745300565331491",
"158404017557381302874717959292955917807",
"249254770200217024300083387997306854865",
"94886624670636247945353767013774200613",
"152325123724031571207758007022494472448",
"206332651888876200503781608815082859436",
"60535897269242853526873253646870475347",
"12052173193207731243161423072639506757"
]
},
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-8c02e8a0"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454d732dfd0aef7d7aa950c409215ca06d717e93",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "46951822708059935444826590687224198861",
"length": 1034.0
},
"target": {
"function": "compat_insnlist",
"file": "drivers/staging/comedi/comedi_compat32.c"
},
"id": "CVE-2025-38481-9387d77b"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454d732dfd0aef7d7aa950c409215ca06d717e93",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42164568039305110874132782907265281861",
"281881328137022797581806335749729355683",
"72218986149681630506418881193771411538",
"337244491465111644373165790626643577351",
"46534011798495086059493773027496299442",
"130095162196400463694812558961152329625"
]
},
"target": {
"file": "drivers/staging/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-b40fa5ac"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ae4b20f5e82101d77326ecab9089e110f224cc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "54228153440498613394218061231334767203",
"length": 703.0
},
"target": {
"function": "compat_insnlist",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-c0fb2944"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3b8322cc8081d142ee4c1a43e1d702bdba1ed76",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "62660849855065595756777087534953127479",
"length": 3098.0
},
"target": {
"function": "comedi_unlocked_ioctl",
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-e4c8b2af"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ae4b20f5e82101d77326ecab9089e110f224cc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"250084368284710790406806550503851868363",
"282766432883905258201451069004091919630",
"44920158663535986996595745300565331491",
"158404017557381302874717959292955917807",
"249254770200217024300083387997306854865",
"94886624670636247945353767013774200613",
"152325123724031571207758007022494472448",
"206332651888876200503781608815082859436",
"60535897269242853526873253646870475347",
"12052173193207731243161423072639506757"
]
},
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2025-38481-fec2c9f5"
}
]