CVE-2025-39686

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: Make insn_rw_emulate_bits() do insn->n samples

The `insn_rw_emulate_bits()` function is used as a default handler for

`INSN_READ` instructions for subdevices that have a handler for

`INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default

handler for `INSN_WRITE` instructions for subdevices that have a handler

for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the

`INSN_READ` or `INSN_WRITE` instruction handling with a constructed

`INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE`

instructions are supposed to be able read or write multiple samples,

indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently

only handles a single sample. For `INSN_READ`, the comedi core will

copy `insn->n` samples back to user-space. (That triggered KASAN

kernel-infoleak errors when `insn->n` was greater than 1, but that is

being fixed more generally elsewhere in the com

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References