CVE-2025-68258

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: multiq3: sanitize config options in multiq3_attach()

Syzbot identified an issue [1] in multiq3_attach() that induces a

task timeout due to open() or COMEDI_DEVCONFIG ioctl operations,

specifically, in the case of multiq3 driver.

This problem arose when syzkaller managed to craft weird configuration

options used to specify the number of channels in encoder subdevice.

If a particularly great number is passed to s->n_chan in

multiq3_attach() via it->options[2], then multiple calls to

multiq3_encoder_reset() at the end of driver-specific attach() method

will be running for minutes, thus blocking tasks and affected devices

as well.

While this issue is most likely not too dangerous for real-life

devices, it still makes sense to sanitize configuration inputs. Enable

a sensible limit on the number of encoder chips (4 chips max, each

with 2 channels) to stop this behaviour from manifesting.

[1] Syzbot crash:

INFO:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References