CVE-2026-43340

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

comedi: Reinit dev->spinlock between attachments to low-level drivers

`struct comedi_device` is the main controlling structure for a COMEDI

device created by the COMEDI subsystem. It contains a member `spinlock`

containing a spin-lock that is initialized by the COMEDI subsystem, but

is reserved for use by a low-level driver attached to the COMEDI device

(at least since commit 25436dc9d84f ("Staging: comedi: remove RT

code")).

Some COMEDI devices (those created on initialization of the COMEDI

subsystem when the "comedi.comedi_num_legacy_minors" parameter is

non-zero) can be attached to different low-level drivers over their

lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in

inconsistent lock states being reported when there is a mismatch in the

spin-lock locking levels used by each low-level driver to which the

COMEDI device has been attached. Fix it by reinitializing

`dev->spinlock` before ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References