CVE-2025-68335

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()

Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from

the fact that in case of early device detach via pcl818_detach(),

subdevice dev->read_subdev may not have initialized its pointer to

&struct comedi_async as intended. Thus, any such dereferencing of

&s->async->cmd will lead to general protection fault and kernel crash.

Mitigate this problem by removing a call to pcl818_ai_cancel() from

pcl818_detach() altogether. This way, if the subdevice setups its

support for async commands, everything async-related will be

handled via subdevice's own ->cancel() function in

comedi_device_detach_locked() even before pcl818_detach(). If no

support for asynchronous commands is provided, there is no need

to cancel anything either.

[1] Syzbot crash:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References