CVE-2025-38687 (GCVE-0-2025-38687)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:32 – Updated: 2026-08-05 12:03
VLAI
Title
comedi: fix race between polling and detaching
Summary
In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < fe67122ba781df44a1a9716eb1dfd751321ab512 (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < cd4286123d6948ff638ea9cd5818ae4796d5d252 (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < d85fac8729c9acfd72368faff1d576ec585e5c8f (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 0f989f9d05492028afd2bded4b42023c57d8a76e (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4 (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 017198079551a2a5cf61eae966af3c4b145e1f3b (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 71ca60d2e631cf9c63bcbc7017961c61ff04e419 (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 5724e82df4f9a4be62908362c97d522d25de75dd (git)
Affected: 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 , < 35b6fc51c666fc96355be5cd633ed0fe4ccf68b2 (git)
Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:14.570Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:05:27.295Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c",
            "drivers/comedi/comedi_internal.h",
            "drivers/comedi/drivers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe67122ba781df44a1a9716eb1dfd751321ab512",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "cd4286123d6948ff638ea9cd5818ae4796d5d252",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "d85fac8729c9acfd72368faff1d576ec585e5c8f",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "0f989f9d05492028afd2bded4b42023c57d8a76e",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "017198079551a2a5cf61eae966af3c4b145e1f3b",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "71ca60d2e631cf9c63bcbc7017961c61ff04e419",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "5724e82df4f9a4be62908362c97d522d25de75dd",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            },
            {
              "lessThan": "35b6fc51c666fc96355be5cd633ed0fe4ccf68b2",
              "status": "affected",
              "version": "2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/comedi/comedi_fops.c",
            "drivers/comedi/comedi_internal.h",
            "drivers/comedi/drivers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: fix race between polling and detaching\n\nsyzbot reports a use-after-free in comedi in the below link, which is\ndue to comedi gladly removing the allocated async area even though poll\nrequests are still active on the wait_queue_head inside of it. This can\ncause a use-after-free when the poll entries are later triggered or\nremoved, as the memory for the wait_queue_head has been freed.  We need\nto check there are no tasks queued on any of the subdevices\u0027 wait queues\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\nioctl.\n\nTasks will read-lock `dev-\u003eattach_lock` before adding themselves to the\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\nhandler by write-locking `dev-\u003eattach_lock` before checking that all of\nthe subdevices are safe to be deleted.  This includes testing for any\nsleepers on the subdevices\u0027 wait queues.  It remains locked until the\ndevice has been detached.  This requires the `comedi_device_detach()`\nfunction to be refactored slightly, moving the bulk of it into new\nfunction `comedi_device_detach_locked()`.\n\nNote that the refactor of `comedi_device_detach()` results in\n`comedi_device_cancel_all()` now being called while `dev-\u003eattach_lock`\nis write-locked, which wasn\u0027t the case previously, but that does not\nmatter.\n\nThanks to Jens Axboe for diagnosing the problem and co-developing this\npatch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to a comedi character device node (`/dev/comediN`) to issue `poll`/`epoll_ctl` and `COMEDI_DEVCONFIG` ioctls. There is no network-facing path into the comedi core.\nAC:L - With epoll the wait-queue registration persists indefinitely after `comedi_poll()` returns, so no race window has to be won \u2014 the attacker deterministically leaves a dangling entry on `\u0026s-\u003easync-\u003ewait_head` and controls when the freed object is dereferenced (`EPOLL_CTL_DEL`/`close`), leaving ample time to reclaim the freed slab.\nPR:L - `comedi_open()` imposes no capability check on an already-attached device, so an ordinary user with access to `/dev/comediN` \u2014 the standard configuration on DAQ/lab/industrial hosts where udev grants board access to a user group \u2014 can register the poll entry that becomes the dangling reference.\nUI:R - The free itself comes from `COMEDI_DEVCONFIG` (or driver teardown), which is gated on `capable(CAP_SYS_ADMIN)` in the init user namespace, so a separate privileged user must perform the routine detach/reconfiguration that triggers the planted use-after-free.\nS:U - The corruption is confined to kernel heap memory managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The dangling `wait_queue_head_t` lets the attacker reclaim the freed `struct comedi_async` with a controlled object and read back kernel list pointers, and a working write primitive from the same UAF enables arbitrary kernel memory disclosure.\nI:H - `remove_wait_queue()`/`ep_remove_wait_queue()` perform `spin_lock` and `list_del` on the freed, attacker-reclaimed memory, giving a classic unlink write of attacker-chosen pointers into attacker-chosen addresses \u2014 sufficient for privilege escalation.\nA:H - Even without successful exploitation the use-after-free on the wait queue head reliably corrupts the slab and oopses or panics the kernel, and it can be triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:57.908Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252"
        },
        {
          "url": "https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419"
        },
        {
          "url": "https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2"
        }
      ],
      "title": "comedi: fix race between polling and detaching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38687",
    "datePublished": "2025-09-04T15:32:41.702Z",
    "dateReserved": "2025-04-16T04:51:24.032Z",
    "dateUpdated": "2026-08-05T12:03:57.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38687",
      "date": "2026-08-07",
      "epss": "0.00124",
      "percentile": "0.02499"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-13T01:44:19.000Z",
      "cve": "CVE-2025-38687",
      "id": "msrc_CVE-2025-38687",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "comedi: fix race between polling and detaching",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38687.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38687\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-04T16:15:36.700\",\"lastModified\":\"2026-07-30T06:23:35.070\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncomedi: fix race between polling and detaching\\n\\nsyzbot reports a use-after-free in comedi in the below link, which is\\ndue to comedi gladly removing the allocated async area even though poll\\nrequests are still active on the wait_queue_head inside of it. This can\\ncause a use-after-free when the poll entries are later triggered or\\nremoved, as the memory for the wait_queue_head has been freed.  We need\\nto check there are no tasks queued on any of the subdevices\u0027 wait queues\\nbefore allowing the device to be detached by the `COMEDI_DEVCONFIG`\\nioctl.\\n\\nTasks will read-lock `dev-\u003eattach_lock` before adding themselves to the\\nsubdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl\\nhandler by write-locking `dev-\u003eattach_lock` before checking that all of\\nthe subdevices are safe to be deleted.  This includes testing for any\\nsleepers on the subdevices\u0027 wait queues.  It remains locked until the\\ndevice has been detached.  This requires the `comedi_device_detach()`\\nfunction to be refactored slightly, moving the bulk of it into new\\nfunction `comedi_device_detach_locked()`.\\n\\nNote that the refactor of `comedi_device_detach()` results in\\n`comedi_device_cancel_all()` now being called while `dev-\u003eattach_lock`\\nis write-locked, which wasn\u0027t the case previously, but that does not\\nmatter.\\n\\nThanks to Jens Axboe for diagnosing the problem and co-developing this\\npatch.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/comedi/comedi_fops.c\",\"drivers/comedi/comedi_internal.h\",\"drivers/comedi/drivers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"fe67122ba781df44a1a9716eb1dfd751321ab512\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"cd4286123d6948ff638ea9cd5818ae4796d5d252\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"d85fac8729c9acfd72368faff1d576ec585e5c8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"0f989f9d05492028afd2bded4b42023c57d8a76e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"017198079551a2a5cf61eae966af3c4b145e1f3b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"71ca60d2e631cf9c63bcbc7017961c61ff04e419\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"5724e82df4f9a4be62908362c97d522d25de75dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1\",\"lessThan\":\"35b6fc51c666fc96355be5cd633ed0fe4ccf68b2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/comedi/comedi_fops.c\",\"drivers/comedi/comedi_internal.h\",\"drivers/comedi/drivers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.297\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.149\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.3,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14\",\"versionEndExcluding\":\"5.4.297\",\"matchCriteriaId\":\"70083655-66F5-4925-B3B5-21D2434F71E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"D0D21C35-EB8A-488A-BBF9-403E4817E5DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"AD9E597F-3DDE-4D7E-976C-463D0611F13F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.149\",\"matchCriteriaId\":\"FDBE8280-8983-4D2D-943D-2E6D0104E2D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"F2293654-7169-49B5-8D0D-EE51EF8B8E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"472C5F87-2BF3-4FAB-9B21-DA7513977363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/017198079551a2a5cf61eae966af3c4b145e1f3b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0f989f9d05492028afd2bded4b42023c57d8a76e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/35b6fc51c666fc96355be5cd633ed0fe4ccf68b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5724e82df4f9a4be62908362c97d522d25de75dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/71ca60d2e631cf9c63bcbc7017961c61ff04e419\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd4286123d6948ff638ea9cd5818ae4796d5d252\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d85fac8729c9acfd72368faff1d576ec585e5c8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe67122ba781df44a1a9716eb1dfd751321ab512\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:33:38+00:00",
      "cve": "CVE-2025-38687",
      "id": "CVE-2025-38687",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: comedi: fix race between polling and detaching",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38687.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.