CVE-2025-38481: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large. Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 2.6.29, before 5.4.297 (fixed in 5.4.297); from 5.5, before 5.10.241 (fixed in 5.10.241); from 5.11, before 5.15.190 (fixed in 5.15.190); from 5.16, before 6.1.147 (fixed in 6.1.147); from 6.2, before 6.6.100 (fixed in 6.6.100); from 6.7, before 6.12.40 (fixed in 6.12.40); …

Published 2025-07-28. Last modified 2026-06-17.