Critical Vulnerability in Linux Kernel: Out of Bounds Bit Shift in IRQ Handling
Summary
CVE-2025-38482: In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: /* IRQs 2,3,5,6,7, 10,11,15 are valid... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is widely used in various distributions, including Debian. This vulnerability affects the kernel's handling of interrupt requests (IRQs) in the comedi driver, specifically the das6402 device, which is responsible for data acquisition and control in various hardware setups.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the comedi driver for the das6402 device. The issue arises from an unchecked integer value from userspace, which is used to determine valid IRQ numbers. This can lead to a bit shift operation that is out of bounds, potentially causing system instability or crashes. The vulnerability allows for negative or excessively large shift amounts, which can compromise the integrity of the kernel's IRQ handling mechanism.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the use of the das6402 device or avoid using IRQs until the kernel is updated. This can be done by configuring the device settings to disable interrupts.
Conclusion
The CVE-2025-38482 vulnerability in the Linux kernel poses significant risks due to improper handling of IRQs in the comedi driver. Users are strongly advised to update their kernel to the latest version to mitigate these risks. For those unable to update immediately, temporary workarounds are available.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38482 is a vulnerability in the Linux kernel's comedi driver that allows for out-of-bounds bit shifts due to unchecked user input.
The vulnerability can lead to system crashes, instability, or unauthorized access to kernel-level operations, affecting overall system security.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
Yes, a patch has been released in the latest versions of the Linux kernel. Users should update their kernel package to ensure they are protected.
If an immediate update is not possible, consider disabling the das6402 device or avoiding its use until the kernel can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
