CVE-2025-38481— Linux kernel 安全漏洞
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 18
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Linux | Linux | ed9eccbe8970f6eedc1b978c157caf1251a896d4< 454d732dfd0aef7d7aa950c409215ca06d717e93 | affected |
ed9eccbe8970f6eedc1b978c157caf1251a896d4< c68257588e87f45530235701a42496b7e9e56adb | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< 69dc06b9514522de532e997a21d035cd29b0db44 | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< d4c73ce13f5b5a0fe0319f1f352ff602f0ace8e3 | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< c9d3d9667443caafa804cd07940aeaef8e53aa90 | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< 992d600f284e719242a434166e86c1999649b71c | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< e3b8322cc8081d142ee4c1a43e1d702bdba1ed76 | affected | ||
ed9eccbe8970f6eedc1b978c157caf1251a896d4< 08ae4b20f5e82101d77326ecab9089e110f224cc | affected | ||
| … +10 more rows | |||
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2025-38481の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
ソース: CVE Program / CVE List V5
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi_insn`, getting the length from the `n_insns` member of the `struct comedi_insnlist` supplied by the user. The allocation will fail with a WARNING and a stack dump if it is too large. Avoid that by failing with an `-EINVAL` error if the supplied `n_insns` value is unreasonable. Define the limit on the `n_insns` value in the `MAX_INSNS` macro. Set this to the same value as `MAX_SAMPLES` (65536), which is the maximum allowed sum of the values of the member `n` in the array of `struct comedi_insn`, and sensible comedi instructions will have an `n` of at least 1.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证n_insns大小，可能导致内存分配失败。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2025-38481の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2025-38481のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-07-28 · 29 CVEs total
| CVE-2025-38490 | 9.8 CRITICAL | net: libwx: remove duplicate page_pool_put_full_page() |
| CVE-2025-38488 | 9.8 CRITICAL | smb: client: fix use-after-free in crypt_message when using async crypto |
| CVE-2025-38471 | 9.8 CRITICAL | tls: always refresh the queue when reading sock |
| CVE-2025-38472 | 9.8 CRITICAL | netfilter: nf_conntrack: fix crash due to removal of uninitialised entry |
| CVE-2025-38476 | 9.8 CRITICAL | rpl: Fix use-after-free in rpl_do_srh_inline(). |
| CVE-2025-38495 | 8.8 HIGH | HID: core: ensure the allocated report buffer can contain the reserved report ID |
| CVE-2025-38491 | 8.2 HIGH | mptcp: make fallback action and fallback decision atomic |
| CVE-2025-38478 | 7.8 HIGH | comedi: Fix initialization of data for instructions that write to subdevice |
| CVE-2025-38485 | 7.8 HIGH | iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush |
| CVE-2025-38486 | 7.8 HIGH | soundwire: Revert "soundwire: qcom: Add set_channel_map api support" |
| CVE-2025-38484 | 7.8 HIGH | iio: backend: fix out-of-bound write |
| CVE-2025-38494 | 7.8 HIGH | HID: core: do not bypass hid_hw_raw_request |
| CVE-2025-38477 | 7.8 HIGH | net/sched: sch_qfq: Fix race condition on qfq_aggregate |
| CVE-2025-38475 | 7.8 HIGH | smc: Fix various oops due to inet_sock type confusion. |
| CVE-2025-38470 | 7.8 HIGH | net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime |
| CVE-2025-38493 | tracing/osnoise: Fix crash in timerlat_dump_stack() | |
| CVE-2025-38492 | netfs: Fix race between cache write completion and ALL_QUEUED being set | |
| CVE-2025-38497 | usb: gadget: configfs: Fix OOB read on empty string write | |
| CVE-2025-38496 | dm-bufio: fix sched in atomic context | |
| CVE-2025-38468 | net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree |
Showing 20 of 29 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
同じベンダー: Linux
- CVE-2026-68450
btrfs: free mapping node on duplicate reloc root insert - CVE-2026-68449
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion - CVE-2026-68448
ovl: check access to copy_file_range source with src mounter - CVE-2026-68447
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to B - CVE-2026-68446
drm/vmwgfx: Validate vmw_surface_metadata::array_size
V. CVE-2025-38481へのコメント
まだコメントはありません