CVE-2025-40106: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.

Affected products

• Linux Linux: from 2.6.29, before 5.4.301 (fixed in 5.4.301); from 5.5, before 5.10.246 (fixed in 5.10.246); from 5.11, before 5.15.196 (fixed in 5.15.196); from 5.16, before 6.1.158 (fixed in 6.1.158); from 6.2, before 6.6.115 (fixed in 6.6.115); from 6.7, before 6.12.56 (fixed in 6.12.56); …

Published 2025-10-31. Last modified 2026-06-17.