cbcvebase.
CVE-2025-68258
published 2025-12-16

CVE-2025-68258: In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3_attach() Syzbot identified an issue [1]…

PriorityP423high7.8
EPSS
0.18%
7.2th percentile
In the Linux kernel, the following vulnerability has been resolved: comedi: multiq3: sanitize config options in multiq3_attach() Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver. This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well. While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting. [1] Syzbot crash: INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097 ...

Affected

47 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < f9ff87aac7b37d462246c46d28912d382a8e2ea6f9ff87aac7b37d462246c46d28912d382a8e2ea6
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < 4cde9a7e025cc09b88097c70606f6b30c22880f44cde9a7e025cc09b88097c70606f6b30c22880f4
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < ad7ed3c9c7b8408e8612697bc43a5441fe386c71ad7ed3c9c7b8408e8612697bc43a5441fe386c71
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < 049f14557450351750f929ebfff36d849511e132049f14557450351750f929ebfff36d849511e132
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < 8952bc1973cd54158c35e06bfb8c29ace7375a488952bc1973cd54158c35e06bfb8c29ace7375a48
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < 8dc2f02d3bada9247f00bfd2e5f61f68c389a0a38dc2f02d3bada9247f00bfd2e5f61f68c389a0a3
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < 543f4c380c2e1f35e60528df7cb54705cda7fee3543f4c380c2e1f35e60528df7cb54705cda7fee3
linuxlinux>= 77e01cdbad5175f56027fd6fae00bd0fc175651a < f24c6e3a39fa355dabfb684c9ca82db579534e72f24c6e3a39fa355dabfb684c9ca82db579534e72
linuxlinux_kernel>= 0 < 5.10.249-15.10.249-1
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.63-16.12.63-1
linuxlinux_kernel>= 0 < 6.17.12-16.17.12-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 0 < 6.17.0-19.196.17.0-19.19
linuxlinux_kernel>= 2.6.30 < 5.10.2485.10.248
linuxlinux_kernel>= 5.11.0 < 5.15.1985.15.198
linuxlinux_kernel>= 5.16.0 < 6.1.1606.1.160
linuxlinux_kernel>= 6.13.0 < 6.17.126.17.12
linuxlinux_kernel>= 6.18.0 < 6.18.16.18.1
linuxlinux_kernel>= 6.2.0 < 6.6.1206.6.120
linuxlinux_kernel>= 6.7.0 < 6.12.626.12.62
msrcazl3_kernel_6.6.117.1-1_on_azure_linux_3.0

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.