CVE-2025-68352
Unknown Unknown - Not Provided

Out-of-Bounds Read/Write in Linux Kernel ch341 SPI Driver

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-07-06
AI Q&A
2025-12-24
EPSS Evaluated
2026-07-05
NVD
CVE-2025-68352
EUVD
EUVD-2025-205102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds memory access issue in the Linux kernel's spi ch341 driver. Specifically, the code incorrectly calculates the length of data to copy, leading to reading beyond the source buffer and potentially writing beyond the destination buffer. This happens because the length variable includes an extra byte for a command header, causing the copy operation to exceed buffer boundaries. The fix involves adjusting the copy length to avoid these out-of-bounds accesses.

Impact Analysis

This vulnerability can lead to memory corruption due to out-of-bounds reads and writes. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges if exploited.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the ch341 driver has been fixed to correctly handle the buffer length by copying 'len - 1' bytes instead of 'len'. This prevents out-of-bounds memory access. Avoid using vulnerable kernel versions and apply vendor patches or kernel updates as soon as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-68352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart