GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68352 (GCVE-0-2025-68352)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:32 – Updated: 2026-08-05 12:11
VLAI
Title
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
Summary
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8846739f52afa07e63395c80227dc544f54bd7b1 , < cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974 (git)
Affected: 8846739f52afa07e63395c80227dc544f54bd7b1 , < ea1e43966cd03098fcd5f0d72e6c2901d45fa08d (git)
Affected: 8846739f52afa07e63395c80227dc544f54bd7b1 , < 81841da1f30f66a850cc8796d99ba330aad9d696 (git)
Affected: 8846739f52afa07e63395c80227dc544f54bd7b1 , < 545d1287e40a55242f6ab68bcc1ba3b74088b1bc (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.63 , ≤ 6.12.* (semver)
Unaffected: 6.17.13 , ≤ 6.17.* (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-ch341.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974",
              "status": "affected",
              "version": "8846739f52afa07e63395c80227dc544f54bd7b1",
              "versionType": "git"
            },
            {
              "lessThan": "ea1e43966cd03098fcd5f0d72e6c2901d45fa08d",
              "status": "affected",
              "version": "8846739f52afa07e63395c80227dc544f54bd7b1",
              "versionType": "git"
            },
            {
              "lessThan": "81841da1f30f66a850cc8796d99ba330aad9d696",
              "status": "affected",
              "version": "8846739f52afa07e63395c80227dc544f54bd7b1",
              "versionType": "git"
            },
            {
              "lessThan": "545d1287e40a55242f6ab68bcc1ba3b74088b1bc",
              "status": "affected",
              "version": "8846739f52afa07e63395c80227dc544f54bd7b1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-ch341.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: ch341: fix out-of-bounds memory access in ch341_transfer_one\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\n\nThe \u0027len\u0027 variable is calculated as \u0027min(32, trans-\u003elen + 1)\u0027,\nwhich includes the 1-byte command header.\n\nWhen copying data from \u0027trans-\u003etx_buf\u0027 to \u0027ch341-\u003etx_buf + 1\u0027, using \u0027len\u0027\nas the length is incorrect because:\n\n1. It causes an out-of-bounds read from \u0027trans-\u003etx_buf\u0027 (which has size\n   \u0027trans-\u003elen\u0027, i.e., \u0027len - 1\u0027 in this context).\n2. It can cause an out-of-bounds write to \u0027ch341-\u003etx_buf\u0027 if \u0027len\u0027 is\n   CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341-\u003etx_buf + 1\n   overflows the buffer.\n\nFix this by copying \u0027len - 1\u0027 bytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable function is reached through local write or SPI_IOC_MESSAGE operations on a provisioned spidev device. A malicious USB peripheral alone cannot trigger the faulty copy.\nAC:L - A transfer of at least 32 attacker-controlled bytes deterministically produces the one-byte overflow without a race. The attacker controls the overflowing byte and can repeat requests or perform heap grooming.\nPR:L - Binding spidev normally requires administrator provisioning, but the transfer path has no capability check. Once device-node access is granted, an ordinary unprivileged local user can trigger the bug.\nUI:N - The attacker directly opens the device and submits the transfer; no action by another user is required.\nS:U - The vulnerable SPI driver and the affected kernel memory share the same kernel security authority. This is a conventional local kernel privilege-escalation condition rather than a VM or IOMMU boundary escape.\nC:H - The out-of-bounds access can corrupt an adjacent slab object, potentially enabling control-flow hijacking and arbitrary kernel-memory disclosure. Under the required higher-severity treatment of exploitable memory corruption, confidentiality impact is high.\nI:H - For transfers of at least 32 bytes, the attacker controls the byte written beyond ch341-\u003etx_buf. Corruption of adjacent allocator metadata or kernel objects can plausibly yield arbitrary writes or kernel code execution.\nA:H - The adjacent-object corruption can damage allocator metadata or devres list pointers, causing a kernel oops or panic. The triggering transfer can be submitted repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:00.772Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea1e43966cd03098fcd5f0d72e6c2901d45fa08d"
        },
        {
          "url": "https://git.kernel.org/stable/c/81841da1f30f66a850cc8796d99ba330aad9d696"
        },
        {
          "url": "https://git.kernel.org/stable/c/545d1287e40a55242f6ab68bcc1ba3b74088b1bc"
        }
      ],
      "title": "spi: ch341: fix out-of-bounds memory access in ch341_transfer_one",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68352",
    "datePublished": "2025-12-24T10:32:43.366Z",
    "dateReserved": "2025-12-16T14:48:05.300Z",
    "dateUpdated": "2026-08-05T12:11:00.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68352",
      "date": "2026-09-16",
      "epss": "0.0015",
      "percentile": "0.04546"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68352\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:58.550\",\"lastModified\":\"2026-07-30T06:24:40.013\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspi: ch341: fix out-of-bounds memory access in ch341_transfer_one\\n\\nDiscovered by Atuin - Automated Vulnerability Discovery Engine.\\n\\nThe \u0027len\u0027 variable is calculated as \u0027min(32, trans-\u003elen + 1)\u0027,\\nwhich includes the 1-byte command header.\\n\\nWhen copying data from \u0027trans-\u003etx_buf\u0027 to \u0027ch341-\u003etx_buf + 1\u0027, using \u0027len\u0027\\nas the length is incorrect because:\\n\\n1. It causes an out-of-bounds read from \u0027trans-\u003etx_buf\u0027 (which has size\\n   \u0027trans-\u003elen\u0027, i.e., \u0027len - 1\u0027 in this context).\\n2. It can cause an out-of-bounds write to \u0027ch341-\u003etx_buf\u0027 if \u0027len\u0027 is\\n   CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341-\u003etx_buf + 1\\n   overflows the buffer.\\n\\nFix this by copying \u0027len - 1\u0027 bytes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/spi/spi-ch341.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8846739f52afa07e63395c80227dc544f54bd7b1\",\"lessThan\":\"cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8846739f52afa07e63395c80227dc544f54bd7b1\",\"lessThan\":\"ea1e43966cd03098fcd5f0d72e6c2901d45fa08d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8846739f52afa07e63395c80227dc544f54bd7b1\",\"lessThan\":\"81841da1f30f66a850cc8796d99ba330aad9d696\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8846739f52afa07e63395c80227dc544f54bd7b1\",\"lessThan\":\"545d1287e40a55242f6ab68bcc1ba3b74088b1bc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/spi/spi-ch341.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.63\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.13\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.2\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/545d1287e40a55242f6ab68bcc1ba3b74088b1bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81841da1f30f66a850cc8796d99ba330aad9d696\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea1e43966cd03098fcd5f0d72e6c2901d45fa08d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:35:26+00:00",
      "cve": "CVE-2025-68352",
      "id": "CVE-2025-68352",
      "initial_release_date": "2025-12-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Out-of-bounds memory access in spi-ch341 driver",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68352.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.