CVE-2025-68257: comedi: check device's attached status in compat ioctls

Deferred
AliasesUBUNTU-CVE-2025-68257DEBIAN-CVE-2025-68257
Published 16-12-2025Last modified 11-05-2026

Vulnerability summary

CVE-2025-68257 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.5% of scored vulnerabilities.

Priority
Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 47 · Related 45
DLA-4475-1DLA-4476-1DSA-6127-1OPENSUSE-SU-2025:15836-1OPENSUSE-SU-2026:10301-1OPENSUSE-SU-2026:20145-1

Timeline

  1. 16-12-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: comedi: check device's attached status in compat ioctls Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig(). As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG. Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback. Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions. [1] Syzbot report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] ...

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

10%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.20% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: not stated in public data.

Ubuntu144 products
  • linux< 5.15.0-173.183 | < 6.8.0-110.110 | < 6.17.0-19.19
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1103.110 | < 6.8.0-1052.55 | < 6.17.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.162-1 | < 6.12.63-1 | < 6.17.12-1
Linux1 product
  • linux≥ 3fbfd2223a271426509830e6340c386a1054cfad, < 4836ba483a22ebd076c8faaf8293a7295fad4142 | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < 7141915bf0c41cb57d83cdbaf695b8c731b16b71 | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < f13895c03620933a58907e3250016f087e39b78c | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < b975f91de5f8f63cf490f0393775cc795f8b0557 | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < f6e629dfe6f590091c662a87c9fcf118b1c1c7dc | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < 573b07d2e3d473ee7eb625ef87519922cf01168d | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < aac80e912de306815297a3b74f0426873ffa7dc3 | ≥ 3fbfd2223a271426509830e6340c386a1054cfad, < 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee | 5.8

3 vendors · 146 products

References

42 links
Show all 42 references