CVE-2025-68332

{
  "id": "CVE-2025-68332",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-22T17:16:00.910",
  "lastModified": "2026-10-19T21:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: c6xdigio: Fix invalid PNP driver unregistration\n\nThe Comedi low-level driver \"c6xdigio\" seems to be for a parallel port\nconnected device.  When the Comedi core calls the driver's Comedi\n\"attach\" handler `c6xdigio_attach()` to configure a Comedi to use this\ndriver, it tries to enable the parallel port PNP resources by\nregistering a PNP driver with `pnp_register_driver()`, but ignores the\nreturn value.  (The `struct pnp_driver` it uses has only the `name` and\n`id_table` members filled in.)  The driver's Comedi \"detach\" handler\n`c6xdigio_detach()` unconditionally unregisters the PNP driver with\n`pnp_unregister_driver()`.\n\nIt is possible for `c6xdigio_attach()` to return an error before it\ncalls `pnp_register_driver()` and it is possible for the call to\n`pnp_register_driver()` to return an error (that is ignored).  In both\ncases, the driver should not be calling `pnp_unregister_driver()` as it\ndoes in `c6xdigio_detach()`.  (Note that `c6xdigio_detach()` will be\ncalled by the Comedi core if `c6xdigio_attach()` returns an error, or if\nthe Comedi core decides to detach the Comedi device from the driver for\nsome other reason.)\n\nThe unconditional call to `pnp_unregister_driver()` without a previous\nsuccessful call to `pnp_register_driver()` will cause\n`driver_unregister()` to issue a warning \"Unexpected driver\nunregister!\".  This was detected by Syzbot [1].\n\nAlso, the PNP driver registration and unregistration should be done at\nmodule init and exit time, respectively, not when attaching or detaching\nComedi devices to the driver.  (There might be more than one Comedi\ndevice being attached to the driver, although that is unlikely.)\n\nChange the driver to do the PNP driver registration at module init time,\nand the unregistration at module exit time.  Since `c6xdigio_detach()`\nnow only calls `comedi_legacy_detach()`, remove the function and change\nthe Comedi driver \"detach\" handler to `comedi_legacy_detach`.\n\n-------------------------------------------\n[1] Syzbot sample crash report:\nUnexpected driver unregister!\nWARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline]\nWARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270\nModules linked in:\nCPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\nRIP: 0010:driver_unregister drivers/base/driver.c:273 [inline]\nRIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270\nCode: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41\nRSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8\nRDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660\nR13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000\nFS:  000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0\nCall Trace:\n <TASK>\n comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207\n comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215\n comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011\n do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872\n comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_sys\n---truncated---"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha corregido la siguiente vulnerabilidad:\\n\\ncomedi: c6xdigio: Corrección de la anulación de registro de controlador PNP no válida\\n\\nEl controlador de bajo nivel Comedi 'c6xdigio' parece estar destinado a un dispositivo conectado a un puerto paralelo. Cuando el núcleo Comedi llama al manejador 'attach' del controlador 'c6xdigio_attach()' para configurar un dispositivo Comedi que use este controlador, intenta habilitar los recursos PNP del puerto paralelo registrando un controlador PNP con 'pnp_register_driver()', pero ignora el valor de retorno. (La 'struct pnp_driver' que utiliza solo tiene los miembros 'name' e 'id_table' completados.) El manejador 'detach' del controlador Comedi 'c6xdigio_detach()' anula el registro del controlador PNP de forma incondicional mediante 'pnp_unregister_driver()'.\\n\\nEs posible que 'c6xdigio_attach()' devuelva un error antes de llamar a 'pnp_register_driver()' y también es posible que la llamada a 'pnp_register_driver()' devuelva un error (que se ignora). En ambos casos, el controlador no debería estar llamando a 'pnp_unregister_driver()' como lo hace en 'c6xdigio_detach()'. (Obsérvese que 'c6xdigio_detach()' será llamado por el núcleo Comedi si 'c6xdigio_attach()' devuelve un error, o si el núcleo Comedi decide separar el dispositivo Comedi del controlador por alguna otra razón.)\\n\\nLa llamada incondicional a 'pnp_unregister_driver()' sin una llamada previa exitosa a 'pnp_register_driver()' provocará que 'driver_unregister()' emita una advertencia “¡Desregistro de controlador inesperado!”. Esto fue detectado por Syzbot [1].\\n\\nAdemás, el registro y anulación de registro del controlador PNP deben realizarse, respectivamente, en el momento de inicialización y finalización del módulo, no al adjuntar o separar dispositivos Comedi del controlador. (Podría haber más de un dispositivo Comedi adjuntado al controlador, aunque es poco probable.)\\n\\nSe modifica el controlador para que realice el registro del controlador PNP en el momento de inicialización del módulo y la anulación del registro en el momento de finalización del módulo. Dado que 'c6xdigio_detach()' ahora solo llama a 'comedi_legacy_detach()', se elimina la función y se cambia el manejador 'detach' del controlador Comedi a 'comedi_legacy_detach'.\\n\\n-------------------------------------------\\n[1] Informe de caída de muestra de Syzbot:\\nUnexpected driver unregister!\\nWARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline]\\nWARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270\\nModules linked in:\\nCPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025\\nRIP: 0010:driver_unregister drivers/base/driver.c:273 [inline]\\nRIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270\\nCode: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 menor que 0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41\\nRSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282\\nRAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8\\nRDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001\\nRBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\\nR10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660\\nR13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000\\nFS:  000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0\\nCall Trace:\\n <TASK>\\n comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207\\n comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215\\n comedi_device_attach+0x43d/0x900 --TRUNCADO--"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/comedi/drivers/c6xdigio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "407b25bb9284d69c27309e691ab1e02f9e1c46ac",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "f7fa1f4670c3c358a451546f0b80b9231952912d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "e8110402b0c24d822b0b933d87d50870d59667ef",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "72b3627b0d3b819de49b29c2c8cb1c64d54536b9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "9fd8c8ad35c8d2390ce5ca2eb523c044bebdc072",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "698149d797d0178162f394c55d4ed52aa0e0b7f6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "888f7e2847bcb9df8257e656e1e837828942c53b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "2c89e159cd2f386285e9522d6476dd7e801bee22",
              "lessThan": "72262330f7b3ad2130e800cecf02adcce3c32c77",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/comedi/drivers/c6xdigio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.30",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.30",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.248",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.198",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.160",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.120",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.62",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.12",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.1",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.19",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/407b25bb9284d69c27309e691ab1e02f9e1c46ac",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/698149d797d0178162f394c55d4ed52aa0e0b7f6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/72262330f7b3ad2130e800cecf02adcce3c32c77",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/72b3627b0d3b819de49b29c2c8cb1c64d54536b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/888f7e2847bcb9df8257e656e1e837828942c53b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fd8c8ad35c8d2390ce5ca2eb523c044bebdc072",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e8110402b0c24d822b0b933d87d50870d59667ef",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f7fa1f4670c3c358a451546f0b80b9231952912d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}