CVE-2025-38529 Details
Description
In the Linux kernel, the following vulnerability has been resolved: comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts.
A vulnerability in the Linux kernel's Comedi driver for the AIO IIRO 16 interface has been addressed. The issue involved an unchecked integer value from userspace, which could lead to a bit shift operation being out of bounds when verifying supported IRQ numbers. This flaw allowed for potential manipulation of interrupt handling. The vulnerability affected several versions of the Linux kernel, specifically versions 5.13 and later.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the updated kernel can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/43ddd82e6a91913cea1c078e782afd8de60c3a53 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5ac7c60439236fb691b8c7987390e2327bbf18fa | kernel.org | Patch |
| https://git.kernel.org/stable/c/66acb1586737a22dd7b78abc63213b1bcaa100e4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/955e8835855fed8e87f7d8c8075564a1746c1b4c | kernel.org | Patch |
| https://git.kernel.org/stable/c/a88692245c315bf8e225f205297a6f4b13d6856a | kernel.org | Patch |
| https://git.kernel.org/stable/c/c593215385f0c0163015cca4512ed3ff42875d19 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e0f3c0867d7d231c70984f05c97752caacd0daba | kernel.org | Patch |
| https://git.kernel.org/stable/c/ff30dd3f15f443d2a0085b12ec2cc95d44f35fa7 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.0, < 5.4.297 >= 5.5, < 5.10.241 >= 5.11, < 5.15.190 >= 5.16, < 6.1.147 >= 6.2, < 6.6.100 >= 6.7, < 6.12.40 >= 6.13, < 6.15.8 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 6.16 rc5 6.16 rc6 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 28, 2025 | CVE Modified | kernel.org |
| Aug 16, 2025 | New CVE Received | kernel.org |