CVE-2025-68773 (GCVE-0-2025-68773)
Vulnerability from cvelistv5
Published
2026-01-13 15:28
Modified
2026-02-09 08:33
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even.
References
Impacted products
Vendor Product Version
Linux Linux Version: 60afe299bb541a928ba39bcb4ae8d3e428d1c5a5
Version: 4badd33929c05ed314794b95f1af1308f7222be8
Version: 7f6738e003b364783f3019fdf6e7645bc8dd1643
Version: fc96ec826bced75cc6b9c07a4ac44bbf651337ab
Version: fc96ec826bced75cc6b9c07a4ac44bbf651337ab
Version: fc96ec826bced75cc6b9c07a4ac44bbf651337ab
Version: fc96ec826bced75cc6b9c07a4ac44bbf651337ab
Version: 42c04316d9275ec267d36e5e9064cd56c9884148
Version: dc120f2d35b030390a2bc0f94dd5f37e900cae91
Version: b558275c1b040f0e5aa56c862241f9212b6118c3
Version: b9d9e8856f1c83e4277403f9b4c369b322ebcb12
Version: 36a6d0f66c874666caf4e8be155b1be30f6231be
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-fsl-spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8f1d35076b78df61ace737e41cc1f4b7b63236c",
              "status": "affected",
              "version": "60afe299bb541a928ba39bcb4ae8d3e428d1c5a5",
              "versionType": "git"
            },
            {
              "lessThan": "9c34a4a2ead00979d203a8c16bea87f0ef5291d8",
              "status": "affected",
              "version": "4badd33929c05ed314794b95f1af1308f7222be8",
              "versionType": "git"
            },
            {
              "lessThan": "837a23a11e0f734f096c7c7b0778d0e625e3dc87",
              "status": "affected",
              "version": "7f6738e003b364783f3019fdf6e7645bc8dd1643",
              "versionType": "git"
            },
            {
              "lessThan": "3dd6d01384823e1bd8602873153d6fc4337ac4fe",
              "status": "affected",
              "version": "fc96ec826bced75cc6b9c07a4ac44bbf651337ab",
              "versionType": "git"
            },
            {
              "lessThan": "743cebcbd1b2609ec5057ab474979cef73d1b681",
              "status": "affected",
              "version": "fc96ec826bced75cc6b9c07a4ac44bbf651337ab",
              "versionType": "git"
            },
            {
              "lessThan": "be0b613198e6bfa104ad520397cab82ad3ec1771",
              "status": "affected",
              "version": "fc96ec826bced75cc6b9c07a4ac44bbf651337ab",
              "versionType": "git"
            },
            {
              "lessThan": "1417927df8049a0194933861e9b098669a95c762",
              "status": "affected",
              "version": "fc96ec826bced75cc6b9c07a4ac44bbf651337ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42c04316d9275ec267d36e5e9064cd56c9884148",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dc120f2d35b030390a2bc0f94dd5f37e900cae91",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b558275c1b040f0e5aa56c862241f9212b6118c3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b9d9e8856f1c83e4277403f9b4c369b322ebcb12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36a6d0f66c874666caf4e8be155b1be30f6231be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-fsl-spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.10.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "5.15.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "6.1.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.316",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.284",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.244",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-cpm: Check length parity before switching to 16 bit mode\n\nCommit fc96ec826bce (\"spi: fsl-cpm: Use 16 bit mode for large transfers\nwith even size\") failed to make sure that the size is really even\nbefore switching to 16 bit mode. Until recently the problem went\nunnoticed because kernfs uses a pre-allocated bounce buffer of size\nPAGE_SIZE for reading EEPROM.\n\nBut commit 8ad6249c51d0 (\"eeprom: at25: convert to spi-mem API\")\nintroduced an additional dynamically allocated bounce buffer whose size\nis exactly the size of the transfer, leading to a buffer overrun in\nthe fsl-cpm driver when that size is odd.\n\nAdd the missing length parity verification and remain in 8 bit mode\nwhen the length is not even."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T08:33:18.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8f1d35076b78df61ace737e41cc1f4b7b63236c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c34a4a2ead00979d203a8c16bea87f0ef5291d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/837a23a11e0f734f096c7c7b0778d0e625e3dc87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dd6d01384823e1bd8602873153d6fc4337ac4fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/743cebcbd1b2609ec5057ab474979cef73d1b681"
        },
        {
          "url": "https://git.kernel.org/stable/c/be0b613198e6bfa104ad520397cab82ad3ec1771"
        },
        {
          "url": "https://git.kernel.org/stable/c/1417927df8049a0194933861e9b098669a95c762"
        }
      ],
      "title": "spi: fsl-cpm: Check length parity before switching to 16 bit mode",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68773",
    "datePublished": "2026-01-13T15:28:50.686Z",
    "dateReserved": "2025-12-24T10:30:51.035Z",
    "dateUpdated": "2026-02-09T08:33:18.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.