CVE-2025-38687

{"id": "CVE-2025-38687", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "fe67122ba781df44a1a9716eb1dfd751321ab512", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "cd4286123d6948ff638ea9cd5818ae4796d5d252", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "d85fac8729c9acfd72368faff1d576ec585e5c8f", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "0f989f9d05492028afd2bded4b42023c57d8a76e", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "017198079551a2a5cf61eae966af3c4b145e1f3b", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "71ca60d2e631cf9c63bcbc7017961c61ff04e419", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "5724e82df4f9a4be62908362c97d522d25de75dd", "versionType": "git"}, {"status": "affected", "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1", "lessThan": "35b6fc51c666fc96355be5cd633ed0fe4ccf68b2", "versionType": "git"}], "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"status": "unaffected", "version": "0", "lessThan": "3.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.297", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.241", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.43", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.11", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.2", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/comedi/comedi_fops.c", "drivers/comedi/comedi_internal.h", "drivers/comedi/drivers.c"], "defaultStatus": "affected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-09-04T16:15:36.700", "references": [{"url": "https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix race between polling and detaching\n\nsyzbot reports a use-after-free in comedi in the below link, which is\ndue to comedi gladly removing the allocated async area even though poll\nrequests are still active on the wait_queue_head inside of it. This can\ncause a use-after-free when the poll entries are later triggered or\nremoved, as the memory for the wait_queue_head has been freed. We need\nto check there are no tasks queued on any of the subdevices' wait queues\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\nioctl.\n\nTasks will read-lock `dev->attach_lock` before adding themselves to the\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\nhandler by write-locking `dev->attach_lock` before checking that all of\nthe subdevices are safe to be deleted. This includes testing for any\nsleepers on the subdevices' wait queues. It remains locked until the\ndevice has been detached. This requires the `comedi_device_detach()`\nfunction to be refactored slightly, moving the bulk of it into new\nfunction `comedi_device_detach_locked()`.\n\nNote that the refactor of `comedi_device_detach()` results in\n`comedi_device_cancel_all()` now being called while `dev->attach_lock`\nis write-locked, which wasn't the case previously, but that does not\nmatter.\n\nThanks to Jens Axboe for diagnosing the problem and co-developing this\npatch."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: corregir condici\u00f3n de carrera entre el sondeo y la desconexi\u00f3n\n\nsyzbot informa de un uso despu\u00e9s de liberaci\u00f3n en comedi en el enlace de abajo, lo cual se debe a que comedi elimina alegremente el \u00e1rea as\u00edncrona asignada a pesar de que las solicitudes de sondeo siguen activas en la wait_queue_head dentro de ella. Esto puede causar un uso despu\u00e9s de liberaci\u00f3n cuando las entradas de sondeo se activan o eliminan posteriormente, ya que la memoria para la wait_queue_head ha sido liberada. Necesitamos verificar que no hay tareas en cola en ninguna de las colas de espera de los subdispositivos antes de permitir que el dispositivo sea desconectado por el ioctl 'COMEDI_DEVCONFIG'.\n\nLas tareas bloquear\u00e1n en modo lectura 'dev->attach_lock' antes de a\u00f1adirse a la cola de espera del subdispositivo, as\u00ed que se corrige el problema en el gestor del ioctl 'COMEDI_DEVCONFIG' bloqueando en modo escritura 'dev->attach_lock' antes de verificar que todos los subdispositivos son seguros para ser eliminados. Esto incluye probar si hay procesos en espera en las colas de espera de los subdispositivos. Permanece bloqueado hasta que el dispositivo ha sido desconectado. Esto requiere que la funci\u00f3n 'comedi_device_detach()' sea refactorizada ligeramente, moviendo la mayor parte de ella a la nueva funci\u00f3n 'comedi_device_detach_locked()'.\n\nTenga en cuenta que la refactorizaci\u00f3n de 'comedi_device_detach()' resulta en que 'comedi_device_cancel_all()' ahora se llama mientras 'dev->attach_lock' est\u00e1 bloqueado en modo escritura, lo cual no era el caso anteriormente, pero eso no importa.\n\nGracias a Jens Axboe por diagnosticar el problema y codesarrollar este parche."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70083655-66F5-4925-B3B5-21D2434F71E5", "versionEndExcluding": "5.4.297", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}