comedi: fix divide-by-zero in comedi_buf_munge()
In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.246, 5.15.196, 5.4.301, 6.1.158, 6.12.56, 6.17.6, 6.6.115
- CVEs
- CVE-2025-40106
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:54 UTC · Revision 1
Source evidence
comedi: fix divide-by-zero in comedi_buf_munge()
core-osv · Original sourcePublished 31 Oct 2025, 09:41 UTC
In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.
osv:CVE-2025-40106
Kernel
Fixed versions: 5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6
Complete source record
{
"id": "d060a308372a4e3065670ff3a4476b5cdb1cdb124ed081ba164eec9b7d7e1afc",
"url": "https://osv.dev/vulnerability/CVE-2025-40106",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "comedi: fix divide-by-zero in comedi_buf_munge()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: comedi: fix divide-by-zero in comedi_buf_munge() The comedi_buf_munge() function performs a modulo operation `async->munge_chan %= async->cmd.chanlist_len` without first checking if chanlist_len is zero. If a user program submits a command with chanlist_len set to zero, this causes a divide-by-zero error when the device processes data in the interrupt handler path. Add a check for zero chanlist_len at the beginning of the function, similar to the existing checks for !map and CMDF_RAWDATA flag. When chanlist_len is zero, update munge_count and return early, indicating the data was handled without munging. This prevents potential kernel panics from malformed user commands.",
"evidence": "osv:CVE-2025-40106",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.301",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.246",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.196",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.115",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.56",
"evidence": "/affected/1/ranges"
},
{
"value": "6.17.6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2025-40106",
"aliases": [
"CVE-2025-40106"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ed9eccbe8970f6eedc1b978c157caf1251a896d4"
},
{
"fixed": "4ffea48c69cb2b96a281cb7e5e42d706996631db"
},
{
"fixed": "8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c"
},
{
"fixed": "2670932f2465793fea1ef073e40883e8390fa4d9"
},
{
"fixed": "6db19822512396be1a3e1e20c16c97270285ba1a"
},
{
"fixed": "d4854eff25efb06d0d84c13e7129bbdba4125f8c"
},
{
"fixed": "a4bb5d1bc2f238461bcbe5303eb500466690bb2c"
},
{
"fixed": "55520f65fd447e04099a2c44185453c18ea73b7e"
},
{
"fixed": "87b318ba81dda2ee7b603f4f6c55e78ec3e95974"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40106.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.29"
},
{
"fixed": "5.4.301"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.246"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.196"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.115"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.56"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.17.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40106.json"
}
}
],
"modified": "2026-10-28T02:30:37.608310150Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/2670932f2465793fea1ef073e40883e8390fa4d9",
"https://git.kernel.org/stable/c/4ffea48c69cb2b96a281cb7e5e42d706996631db",
"https://git.kernel.org/stable/c/55520f65fd447e04099a2c44185453c18ea73b7e",
"https://git.kernel.org/stable/c/6db19822512396be1a3e1e20c16c97270285ba1a",
"https://git.kernel.org/stable/c/87b318ba81dda2ee7b603f4f6c55e78ec3e95974",
"https://git.kernel.org/stable/c/8f3e4cd9be4b47246ea73ce5e3e0fa2f57f0d10c",
"https://git.kernel.org/stable/c/a4bb5d1bc2f238461bcbe5303eb500466690bb2c",
"https://git.kernel.org/stable/c/d4854eff25efb06d0d84c13e7129bbdba4125f8c",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40106.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-40106",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40106.json"
}
},
"related_cves": [
{
"value": "CVE-2025-40106",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 504958,
"published_at": "2025-10-31T09:41:46.74+00:00"
}