cbcvebase.
CVE-2025-68332
published 2025-12-22

CVE-2025-68332: In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver…

PriorityP422high7.8
EPSS
0.17%
6.7th percentile
In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler `c6xdigio_attach()` to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with `pnp_register_driver()`, but ignores the return value. (The `struct pnp_driver` it uses has only the `name` and `id_table` members filled in.) The driver's Comedi "detach" handler `c6xdigio_detach()` unconditionally unregisters the PNP driver with `pnp_unregister_driver()`. It is possible for `c6xdigio_attach()` to return an error before it calls `pnp_register_driver()` and it is possible for the call to `pnp_register_driver()` to return an error (that is ignored). In both cases, the driver should not be calling `pnp_unregister_driver()` as it does in `c6xdigio_detach()`. (Note that `c6xdigio_detach()` will be called by the Comedi core if `c6xdigio_attach()` returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.) The unconditional call to `pnp_unregister_driver()` without a previous successful call to `pnp_register_driver()` will cause `driver_unregister()` to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1]. Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.) Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since `c6xdigio_detach()` now only calls `comedi_legacy_detach()`, remove the function and change the Comedi driver "detach" handler to `comedi_legacy_detach`. [1

Affected

47 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 407b25bb9284d69c27309e691ab1e02f9e1c46ac407b25bb9284d69c27309e691ab1e02f9e1c46ac
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < f7fa1f4670c3c358a451546f0b80b9231952912df7fa1f4670c3c358a451546f0b80b9231952912d
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < e8110402b0c24d822b0b933d87d50870d59667efe8110402b0c24d822b0b933d87d50870d59667ef
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 72b3627b0d3b819de49b29c2c8cb1c64d54536b972b3627b0d3b819de49b29c2c8cb1c64d54536b9
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 9fd8c8ad35c8d2390ce5ca2eb523c044bebdc0729fd8c8ad35c8d2390ce5ca2eb523c044bebdc072
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 698149d797d0178162f394c55d4ed52aa0e0b7f6698149d797d0178162f394c55d4ed52aa0e0b7f6
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 888f7e2847bcb9df8257e656e1e837828942c53b888f7e2847bcb9df8257e656e1e837828942c53b
linuxlinux>= 2c89e159cd2f386285e9522d6476dd7e801bee22 < 72262330f7b3ad2130e800cecf02adcce3c32c7772262330f7b3ad2130e800cecf02adcce3c32c77
linuxlinux_kernel>= 0 < 5.10.249-15.10.249-1
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.63-16.12.63-1
linuxlinux_kernel>= 0 < 6.17.12-16.17.12-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 0 < 6.17.0-19.196.17.0-19.19
linuxlinux_kernel>= 2.6.30 < 5.10.2485.10.248
linuxlinux_kernel>= 5.11.0 < 5.15.1985.15.198
linuxlinux_kernel>= 5.16.0 < 6.1.1606.1.160
linuxlinux_kernel>= 6.13.0 < 6.17.126.17.12
linuxlinux_kernel>= 6.18.0 < 6.18.16.18.1
linuxlinux_kernel>= 6.2.0 < 6.6.1206.6.120
linuxlinux_kernel>= 6.7.0 < 6.12.626.12.62
msrcazl3_kernel_6.6.117.1-1_on_azure_linux_3.0

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.