CVE-2025-38687 (GCVE-0-2025-38687)
Vulnerability from cvelistv5
Published
2025-09-04 15:32
Modified
2026-08-05 12:03
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
Version: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:14.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:05:27.295Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c",
            "drivers/comedi/comedi_internal.h",
            "drivers/comedi/drivers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe67122ba781df44a1a9716eb1dfd751321ab512",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "cd4286123d6948ff638ea9cd5818ae4796d5d252",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "d85fac8729c9acfd72368faff1d576ec585e5c8f",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "0f989f9d05492028afd2bded4b42023c57d8a76e",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "017198079551a2a5cf61eae966af3c4b145e1f3b",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "71ca60d2e631cf9c63bcbc7017961c61ff04e419",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "5724e82df4f9a4be62908362c97d522d25de75dd",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "35b6fc51c666fc96355be5cd633ed0fe4ccf68b2",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c",
            "drivers/comedi/comedi_internal.h",
            "drivers/comedi/drivers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix race between polling and detaching\n\nsyzbot reports a use-after-free in comedi in the below link, which is\ndue to comedi gladly removing the allocated async area even though poll\nrequests are still active on the wait_queue_head inside of it. This can\ncause a use-after-free when the poll entries are later triggered or\nremoved, as the memory for the wait_queue_head has been freed.  We need\nto check there are no tasks queued on any of the subdevices\u0027 wait queues\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\nioctl.\n\nTasks will read-lock `dev-\u003eattach_lock` before adding themselves to the\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\nhandler by write-locking `dev-\u003eattach_lock` before checking that all of\nthe subdevices are safe to be deleted.  This includes testing for any\nsleepers on the subdevices\u0027 wait queues.  It remains locked until the\ndevice has been detached.  This requires the `comedi_device_detach()`\nfunction to be refactored slightly, moving the bulk of it into new\nfunction `comedi_device_detach_locked()`.\n\nNote that the refactor of `comedi_device_detach()` results in\n`comedi_device_cancel_all()` now being called while `dev-\u003eattach_lock`\nis write-locked, which wasn\u0027t the case previously, but that does not\nmatter.\n\nThanks to Jens Axboe for diagnosing the problem and co-developing this\npatch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to a comedi character device node (`/dev/comediN`) to issue `poll`/`epoll_ctl` and `COMEDI_DEVCONFIG` ioctls. There is no network-facing path into the comedi core.\nAC:L - With epoll the wait-queue registration persists indefinitely after `comedi_poll()` returns, so no race window has to be won \u2014 the attacker deterministically leaves a dangling entry on `\u0026s-\u003easync-\u003ewait_head` and controls when the freed object is dereferenced (`EPOLL_CTL_DEL`/`close`), leaving ample time to reclaim the freed slab.\nPR:L - `comedi_open()` imposes no capability check on an already-attached device, so an ordinary user with access to `/dev/comediN` \u2014 the standard configuration on DAQ/lab/industrial hosts where udev grants board access to a user group \u2014 can register the poll entry that becomes the dangling reference.\nUI:R - The free itself comes from `COMEDI_DEVCONFIG` (or driver teardown), which is gated on `capable(CAP_SYS_ADMIN)` in the init user namespace, so a separate privileged user must perform the routine detach/reconfiguration that triggers the planted use-after-free.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `wait_queue_head_t` lets the attacker reclaim the freed `struct comedi_async` with a controlled object and read back kernel list pointers, and a working write primitive from the same UAF enables arbitrary kernel memory disclosure.\nI:H - `remove_wait_queue()`/`ep_remove_wait_queue()` perform `spin_lock` and `list_del` on the freed, attacker-reclaimed memory, giving a classic unlink write of attacker-chosen pointers into attacker-chosen addresses \u2014 sufficient for privilege escalation.\nA:H - Even without successful exploitation the use-after-free on the wait queue head reliably corrupts the slab and oopses or panics the kernel, and it can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:57.908Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252"
        },
        {
          "url": "https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419"
        },
        {
          "url": "https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2"
        }
      ],
      "title": "comedi: fix race between polling and detaching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38687",
    "datePublished": "2025-09-04T15:32:41.702Z",
    "dateReserved": "2025-04-16T04:51:24.032Z",
    "dateUpdated": "2026-08-05T12:03:57.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.