CVE-2025-38687: linux kernel from 3.14 (inclusive), before 5.4.297 (exclusive), from 5.5 (inclusive), before 5.10.241 (exclusive)…

Affected technology

linux kernel · from 3.14 (inclusive), before 5.4.297 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.241 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.190 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.149 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.103 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.43 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.15.11 (exclusive)
linux

linux kernel · from 6.16 (inclusive), before 6.16.2 (exclusive)
linux

debian linux · 11.0
debian

Linux · 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before fe67122ba781df44a1a9716eb1dfd751321ab512, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before cd4286123d6948ff638ea9cd5818ae4796d5d252, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before d85fac8729c9acfd72368faff1d576ec585e5c8f, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 0f989f9d05492028afd2bded4b42023c57d8a76e, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 5c4a2ffcbd052c69bbf4680677d4c4eaa5a252d4, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 017198079551a2a5cf61eae966af3c4b145e1f3b, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 71ca60d2e631cf9c63bcbc7017961c61ff04e419, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 5724e82df4f9a4be62908362c97d522d25de75dd, 2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1 to before 35b6fc51c666fc96355be5cd633ed0fe4ccf68b2
Linux

Linux · 3.14
Linux

SIMATIC CN 4100 · 0 to before V5.0
Siemens

Component: Not specified by the source
Function: to
File: drivers/comedi/comedi_fops.c, drivers/comedi/comedi_internal.h, drivers/comedi/drivers.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker with low privileges can trigger a use-after-free error. Source advisory’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 4.7/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not state a further attacker outcome.