Bug 2408808 (CVE-2025-40106) - CVE-2025-40106 kernel: comedi: fix divide-by-zero in comedi_buf_munge()
Summary: CVE-2025-40106 kernel: comedi: fix divide-by-zero in comedi_buf_munge()
Keywords:
Status: NEW
Alias: CVE-2025-40106
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-31 10:01 UTC by OSIDB Bzimport
Modified: 2026-06-29 15:39 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-10-31 10:01:37 UTC
In the Linux kernel, the following vulnerability has been resolved:

comedi: fix divide-by-zero in comedi_buf_munge()

The comedi_buf_munge() function performs a modulo operation
`async->munge_chan %= async->cmd.chanlist_len` without first
checking if chanlist_len is zero. If a user program submits a command with
chanlist_len set to zero, this causes a divide-by-zero error when the device
processes data in the interrupt handler path.

Add a check for zero chanlist_len at the beginning of the
function, similar to the existing checks for !map and
CMDF_RAWDATA flag. When chanlist_len is zero, update
munge_count and return early, indicating the data was
handled without munging.

This prevents potential kernel panics from malformed user commands.

Comment 1 Jon Moroney 2025-10-31 16:26:29 UTC Comment hidden (spam)

Note You need to log in before you can comment on or make changes to this bug.