Not yet scoredPublished Dec 16, 2025

CVE-2025-68257comedi: check device's attached status in compat ioctls

Updated under an hour ago (Oct 28, 2026, 6:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig(). As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG. Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback. Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions. [1] Syzbot report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] ...

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3fbfd2223a271426509830e6340c386a1054cfad before 4836ba483a22ebd076c8faaf8293a7295fad4142; from 3fbfd2223a271426509830e6340c386a1054cfad before 7141915bf0c41cb57d83cdbaf695b8c731b16b71; from 3fbfd2223a271426509830e6340c386a1054cfad before f13895c03620933a58907e3250016f087e39b78c; from 3fbfd2223a271426509830e6340c386a1054cfad before b975f91de5f8f63cf490f0393775cc795f8b0557; from 3fbfd2223a271426509830e6340c386a1054cfad before f6e629dfe6f590091c662a87c9fcf118b1c1c7dc; from 3fbfd2223a271426509830e6340c386a1054cfad before 573b07d2e3d473ee7eb625ef87519922cf01168d; from 3fbfd2223a271426509830e6340c386a1054cfad before aac80e912de306815297a3b74f0426873ffa7dc3; 3fbfd2223a271426509830e6340c386a1054cfad builds before 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee	CNA record

References

References

https://git.kernel.org/stable/c/4836ba483a22ebd076c8faaf8293a7295fad4142
https://git.kernel.org/stable/c/7141915bf0c41cb57d83cdbaf695b8c731b16b71
https://git.kernel.org/stable/c/f13895c03620933a58907e3250016f087e39b78c
https://git.kernel.org/stable/c/b975f91de5f8f63cf490f0393775cc795f8b0557
https://git.kernel.org/stable/c/f6e629dfe6f590091c662a87c9fcf118b1c1c7dc
https://git.kernel.org/stable/c/573b07d2e3d473ee7eb625ef87519922cf01168d
https://git.kernel.org/stable/c/aac80e912de306815297a3b74f0426873ffa7dc3
https://git.kernel.org/stable/c/0de7d9cd07a2671fa6089173bccc0b2afe6b93ee

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.