CVE-2025-39684

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl()

syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel

buffer is allocated to hold `insn->n` samples (each of which is an

`unsigned int`). For some instruction types, `insn->n` samples are

copied back to user-space, unless an error code is being returned. The

problem is that not all the instruction handlers that need to return

data to userspace fill in the whole `insn->n` samples, so that there is

an information leak. There is a similar syzbot report for

`do_insnlist_ioctl()`, although it does not have a reproducer for it at

the time of writing.

One culprit is `insn_rw_emulate_bits()` which is used as the handler for

`INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have

a specific handler for that instruction, but do have an `INSN_BITS`

handler. For `INSN_READ` it only fills in at most 1 sample,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References