CVE-2026-43340 Details

A vulnerability exists in the Linux kernel's COMEDI subsystem, specifically within the 'comedi_device' structure, which is crucial for managing COMEDI devices. This structure includes a spinlock that, while initialized by the COMEDI subsystem, is intended for use by low-level drivers attached to the COMEDI device. The issue arises because certain COMEDI devices can be reattached to different low-level drivers over time, leading to potential mismatches in the spinlock's state. When this happens, inconsistent locking behaviors can occur, depending on the locking practices of the various drivers. The vulnerability can be exploited by attaching a COMEDI device to different low-level drivers, creating a mismatch in the spinlock's state and causing inconsistent lock behaviors.

The vulnerability has been addressed by modifying the COMEDI driver's attachment process. The COMEDI subsystem now reinitializes the spinlock before attaching a low-level driver, ensuring that any previous lock dependencies are cleared. Users should update to the latest stable version of the Linux kernel where this fix has been applied.