Name of the Vulnerable Software and Affected Versions:

Linux kernel (affected versions not specified)

Description:

The handling of the `COMEDI INSNLIST` ioctl allocates a kernel buffer to hold the array of `struct comedi insn`, using the length from the `n insns` member of the `struct comedi insnlist` supplied by the user. The allocation can fail, resulting in a WARNING and a stack dump, if `n insns` is too large. This issue is addressed by failing with an `-EINVAL` error if the supplied `n insns` value is unreasonable. The limit on the `n insns` value is defined by the `MAX INSNS` macro, set to the same value as `MAX SAMPLES` (65536).

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.