CVE-2025-68257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: check device's attached status in compat ioctls

Syzbot identified an issue [1] that crashes kernel, seemingly due to

unexistent callback dev->get_valid_routes(). By all means, this should

not occur as said callback must always be set to

get_zero_valid_routes() in __comedi_device_postconfig().

As the crash seems to appear exclusively in i386 kernels, at least,

judging from [1] reports, the blame lies with compat versions

of standard IOCTL handlers. Several of them are modified and

do not use comedi_unlocked_ioctl(). While functionality of these

ioctls essentially copy their original versions, they do not

have required sanity check for device's attached status. This,

in turn, leads to a possibility of calling select IOCTLs on a

device that has not been properly setup, even via COMEDI_DEVCONFIG.

Doing so on unconfigured devices means that several crucial steps

are missed, for instance, specifying dev->get_vali

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References