Answer in brief
CVE-2025-38687 records a High severity (CVSS 7.3) vulnerability in comedi: fix race between polling and detaching. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC CN 4100 (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <fe67122ba781df44a1a9716eb1dfd751321ab512 || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <cd4286123d6948ff638ea9cd5818ae4796d5d252 || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <d85fac8729c9acfd72368faff1d576ec585e5c8f || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <0f989f9d05492028afd2bded4b42023c57d8a76e || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4 || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <017198079551a2a5cf61eae966af3c4b145e1f3b || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <71ca60d2e631cf9c63bcbc7017961c61ff04e419 || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <5724e82df4f9a4be62908362c97d522d25de75dd || >=2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 <35b6fc51c666fc96355be5cd633ed0fe4ccf68b2 | fe67122ba781df44a1a9716eb1dfd751321ab512, cd4286123d6948ff638ea9cd5818ae4796d5d252, d85fac8729c9acfd72368faff1d576ec585e5c8f, 0f989f9d05492028afd2bded4b42023c57d8a76e, 5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4, 017198079551a2a5cf61eae966af3c4b145e1f3b, 71ca60d2e631cf9c63bcbc7017961c61ff04e419, 5724e82df4f9a4be62908362c97d522d25de75dd, 35b6fc51c666fc96355be5cd633ed0fe4ccf68b2 |
| Linux/Linuxgeneric | 3.14 | Not reported |
| Siemens/SIMATIC CN 4100generic | >=0 <V5.0 | V5.0 |
Published upstream
Sep 4, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.
Quoted source text, attributed separately from HOL analysis.