CVE-2025-38687

What it actually does

Race condition in comedi allowing use-after-free of async area wait_queue_head when COMEDI_DEVCONFIG ioctl detaches the device while poll requests remain active on subdevice queues.

Why it matters to the business

Potential kernel crashes or denial of service on Linux systems using comedi drivers; low urgency as not exploited in the wild or tied to ransomware.

How an attack unfolds

An attacker with local access triggers concurrent polling on a subdevice wait queue while issuing the COMEDI_DEVCONFIG ioctl to detach, bypassing attach_lock checks and freeing memory still referenced by active poll entries.

How to fix it

Upgrade the Linux kernel to commit fe67122ba781df44a1a9716eb1dfd751321ab512 or later; refactor ensures attach_lock is held during subdevice safety checks and detach.

How to confirm the fix worked

Confirm kernel includes the referenced commit; attempt reproduction with concurrent poll and detach operations under attach_lock to verify absence of UAF.

Typical attack path

1. Obtain local access to a system with comedi hardware/driver loaded
2. Open comedi device and initiate poll on a subdevice wait queue
3. Race the COMEDI_DEVCONFIG ioctl to detach the device
4. Trigger or remove poll entries to access freed wait_queue_head memory

How to detect it

Review kernel logs and dmesg for use-after-free reports involving comedi wait queues or async areas; correlate with COMEDI_DEVCONFIG ioctl activity.

What your security team should do

• Apply the kernel fix to all affected systems
• Restrict unprivileged access to comedi devices where possible
• Monitor kernel logs for comedi-related oops or UAF reports