CVE-2025-40106

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: fix divide-by-zero in comedi_buf_munge()

The comedi_buf_munge() function performs a modulo operation

`async->munge_chan %= async->cmd.chanlist_len` without first

checking if chanlist_len is zero. If a user program submits a command with

chanlist_len set to zero, this causes a divide-by-zero error when the device

processes data in the interrupt handler path.

Add a check for zero chanlist_len at the beginning of the

function, similar to the existing checks for !map and

CMDF_RAWDATA flag. When chanlist_len is zero, update

munge_count and return early, indicating the data was

handled without munging.

This prevents potential kernel panics from malformed user commands.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References