CVE-2025-38478 comedi: Fix initialization of data for instructions that write to subdevice
A local attacker can read uninitialized kernel memory via Comedi subdevice instructions, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38478?
CVE-2025-38478 is a high-severity vulnerability in Debian Debian Linux, published on 28 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
comedi: Fix initialization of data for instructions that write to subdevice
Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice.
Weakness: CWE-908
Which versions are affected by CVE-2025-38478?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38478?
Apply the vendor's patch.
Is CVE-2025-38478 being exploited?
There is no known exploitation of CVE-2025-38478 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38478, DEBIAN-CVE-2025-38478, GHSA-55hq-rjfv-397f, ROOT-OS-DEBIAN-11-CVE-2025-38478, ROOT-OS-DEBIAN-12-CVE-2025-38478, ROOT-OS-UBUNTU-2204-CVE-2025-38478 and 2 more.