CVE-2025-38478 — Use of Uninitialized Resource in Linux
Severity
5.5MEDIUMNVD
OSV3.2
EPSS
0.0%
top 94.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 28
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
comedi: Fix initialization of data for instructions that write to subdevice
Some Comedi subdevice instruction handlers are known to access
instruction data elements beyond the first `insn->n` elements in some
cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions
allocate at least `MIN_SAMPLES` (16) data elements to deal with this,
but they do not initialize all of that. For Comedi instruction codes
that write to the…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linuxed9eccbe8970f6eedc1b978c157caf1251a896d4 — 6f38c6380c3b38a05032b8881e41137385a6ce02+8
Also affects: Debian Linux 11.0