CVE-2025-40106
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-31 10:15:50.520000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40106",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-31T10:15:50.520",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix divide-by-zero in comedi_buf_munge()\n\nThe comedi_buf_munge() function performs a modulo operation\n`async->munge_chan %= async->cmd.chanlist_len` without first\nchecking if chanlist_len is zero. If a user program submits a command with\nchanlist_len set to zero, this causes a divide-by-zero error when the device\nprocesses data in the interrupt handler path.\n\nAdd a check for zero chanlist_len at the beginning of the\nfunction, similar to the existing checks for !map and\nCMDF_RAWDATA flag. When chanlist_len is zero, update\nmunge_count and return early, indicating the data was\nhandled without munging.\n\nThis prevents potential kernel panics from malformed user commands."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: corrección de división por cero en comedi_buf_munge()\n\nLa función comedi_buf_munge() realiza una operación de módulo 'async->munge_chan %= async->cmd.chanlist_len' sin comprobar primero si chanlist_len es cero. Si un programa de usuario envía un comando con chanlist_len establecido en cero, esto causa un error de división por cero cuando el dispositivo procesa datos en la ruta del gestor de interrupciones.\n\nAñadir una comprobación para chanlist_len cero al principio de la función, similar a las comprobaciones existentes para !map y el flag CMDF_RAWDATA. Cuando chanlist_len es cero, actualizar munge_count y retornar anticipadamente, indicando que los datos fueron gestionados sin munging.\n\nEsto previene posibles pánicos del kernel de comandos de usuario malformados."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/comedi/comedi_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "4ffea48c69cb2b96a281cb7e5e42d706996631db",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "2670932f2465793fea1ef073e40883e8390fa4d9",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "6db19822512396be1a3e1e20c16c97270285ba1a",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "d4854eff25efb06d0d84c13e7129bbdba4125f8c",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "a4bb5d1bc2f238461bcbe5303eb500466690bb2c",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "55520f65fd447e04099a2c44185453c18ea73b7e",
"versionType": "git",
"status": "affected"
},
{
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"lessThan": "87b318ba81dda2ee7b603f4f6c55e78ec3e95974",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/comedi/comedi_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.29",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.29",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.301",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.246",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.196",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.158",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.115",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.56",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.6",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2670932f2465793fea1ef073e40883e8390fa4d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4ffea48c69cb2b96a281cb7e5e42d706996631db",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/55520f65fd447e04099a2c44185453c18ea73b7e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6db19822512396be1a3e1e20c16c97270285ba1a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/87b318ba81dda2ee7b603f4f6c55e78ec3e95974",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4bb5d1bc2f238461bcbe5303eb500466690bb2c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d4854eff25efb06d0d84c13e7129bbdba4125f8c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}