CVE-2025-40106 comedi: fix divide-by-zero in comedi_buf_munge()
A local attacker can cause a kernel panic via divide-by-zero in the comedi driver by submitting a command with a zero channel list length.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40106?
CVE-2025-40106 is a denial of service vulnerability in Linux, published on 31 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
comedi: fix divide-by-zero in comedi_buf_munge()
The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path.
Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging.
This prevents potential kernel panics from malformed user commands.
Which versions are affected by CVE-2025-40106?
How do I fix CVE-2025-40106?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40106 being exploited?
There is no known exploitation of CVE-2025-40106 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40106, DEBIAN-CVE-2025-40106, GHSA-6hvg-fq9h-5pm6, ROOT-OS-DEBIAN-11-CVE-2025-40106, ROOT-OS-DEBIAN-12-CVE-2025-40106, ROOT-OS-DEBIAN-13-CVE-2025-40106 and 3 more.