CVE-2025-38478

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: Fix initialization of data for instructions that write to subdevice<br /> <br /> Some Comedi subdevice instruction handlers are known to access<br /> instruction data elements beyond the first `insn-&gt;n` elements in some<br /> cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions<br /> allocate at least `MIN_SAMPLES` (16) data elements to deal with this,<br /> but they do not initialize all of that. For Comedi instruction codes<br /> that write to the subdevice, the first `insn-&gt;n` data elements are<br /> copied from user-space, but the remaining elements are left<br /> uninitialized. That could be a problem if the subdevice instruction<br /> handler reads the uninitialized data. Ensure that the first<br /> `MIN_SAMPLES` elements are initialized before calling these instruction<br /> handlers, filling the uncopied elements with 0. For<br /> `do_insnlist_ioctl()`, the same data buffer elements are used for<br /> handling a list of instructions, so ensure the first `MIN_SAMPLES`<br /> elements are initialized for each instruction that writes to the<br /> subdevice.