CVE-2025-40106

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: fix divide-by-zero in comedi_buf_munge()<br /> <br /> The comedi_buf_munge() function performs a modulo operation<br /> `async-&gt;munge_chan %= async-&gt;cmd.chanlist_len` without first<br /> checking if chanlist_len is zero. If a user program submits a command with<br /> chanlist_len set to zero, this causes a divide-by-zero error when the device<br /> processes data in the interrupt handler path.<br /> <br /> Add a check for zero chanlist_len at the beginning of the<br /> function, similar to the existing checks for !map and<br /> CMDF_RAWDATA flag. When chanlist_len is zero, update<br /> munge_count and return early, indicating the data was<br /> handled without munging.<br /> <br /> This prevents potential kernel panics from malformed user commands.