CVE-2026-43340

comedi: Reinit dev->spinlock between attachments to low-level drivers

MEDIUM
5.5
CVSS Score
Published: May 8, 2026 at 01:37 PM UTC
Updated: June 17, 2026 at 10:49 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: comedi: Reinit dev->spinlock between attachments to low-level drivers `struct comedi_device` is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member `spinlock` containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit 25436dc9d84f ("Staging: comedi: remove RT code")). Some COMEDI devices (those created on initialization of the COMEDI subsystem when the "comedi.comedi_num_legacy_minors" parameter is non-zero) can be attached to different low-level drivers over their lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in inconsistent lock states being reported when there is a mismatch in the spin-lock locking levels used by each low-level driver to which the COMEDI device has been attached. Fix it by reinitializing `dev->spinlock` before calling the low-level driver's `attach` function pointer if `CONFIG_LOCKDEP` is enabled.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.29 ≤ v < 5.10.2532.6.29 ≤ v < 5.15.2032.6.29 ≤ v < 6.1.1682.6.29 ≤ v < 6.12.812.6.29 ≤ v < 6.18.222.6.29 ≤ v < 6.19.122.6.29 ≤ v < 6.6.1342.6.29 ≤ v < 7.05.11 ≤ v < 5.15.2035.16 ≤ v < 6.1.1686.13 ≤ v < 6.18.226.19 ≤ v < 6.19.126.2 ≤ v < 6.6.1346.7 ≤ v < 6.12.812.6.297.0 rc17.0 rc27.0 rc37.0 rc47.0 rc57.0 rc67.0 rc7ed9eccbe8970f6eedc1b978c157caf1251a896d4
Vendor states this is fixed in 2b1f49e4fdff3ef0f8e9158bbb5b149e06287560 (fixed)
Vendor states this is fixed in 3181c34b415c5464be9d34bff3e43ef63b747039 (fixed)
Vendor states this is fixed in 430291d8f3884f57ae0057049b0ca291453e29e1 (fixed)
Vendor states this is fixed in 4b9a9a6d71e3e252032f959fb3895a33acb5865c (fixed)
Vendor states this is fixed in 4d5ffe524903a30e2e0da7d16841a56bec2de55c (fixed)
Vendor states this is fixed in 83134a7a176ce5b4b19b6edecf4360e8d98d1a5a (fixed)
Vendor states this is fixed in b89c026227712c367950bbae055a5b31073d3b30 (fixed)
Vendor states this is fixed in c01bcc67a9a692d65508ebd480405b5e77d562b7 (fixed)
Vendor states this is fixed in 2.6.29 (unaffected)
Vendor states this is fixed in 5.10.253 (unaffected)
Vendor states this is fixed in 5.15.203 (unaffected)
Vendor states this is fixed in 6.1.168 (unaffected)
Vendor states this is fixed in 6.12.81 (unaffected)
Vendor states this is fixed in 6.18.22 (unaffected)
Vendor states this is fixed in 6.19.12 (unaffected)
Vendor states this is fixed in 6.6.134 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card