CVE-2025-68773

spi: fsl-cpm: Check length parity before switching to 16 bit mode

Published Jan 13, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-cpm: Check length parity before switching to 16 bit mode

Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers
with even size") failed to make sure that the size is really even
before switching to 16 bit mode. Until recently the problem went
unnoticed because kernfs uses a pre-allocated bounce buffer of size
PAGE_SIZE for reading EEPROM.

But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API")
introduced an additional dynamically allocated bounce buffer whose size
is exactly the size of the transfer, leading to a buffer overrun in
the fsl-cpm driver when that size is odd.

Add the missing length parity verification and remain in 8 bit mode
when the length is not even.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`60afe299bb541a928ba39bcb4ae8d3e428d1c5a5`	affected	< c8f1d35076b78df61ace737e41cc1f4b7b63236c
`4badd33929c05ed314794b95f1af1308f7222be8`	affected	< 9c34a4a2ead00979d203a8c16bea87f0ef5291d8
`7f6738e003b364783f3019fdf6e7645bc8dd1643`	affected	< 837a23a11e0f734f096c7c7b0778d0e625e3dc87
`fc96ec826bced75cc6b9c07a4ac44bbf651337ab`	affected	< 3dd6d01384823e1bd8602873153d6fc4337ac4fe
`fc96ec826bced75cc6b9c07a4ac44bbf651337ab`	affected	< 743cebcbd1b2609ec5057ab474979cef73d1b681
`fc96ec826bced75cc6b9c07a4ac44bbf651337ab`	affected	< be0b613198e6bfa104ad520397cab82ad3ec1771
`fc96ec826bced75cc6b9c07a4ac44bbf651337ab`	affected	< 1417927df8049a0194933861e9b098669a95c762
`42c04316d9275ec267d36e5e9064cd56c9884148`	affected	—
`dc120f2d35b030390a2bc0f94dd5f37e900cae91`	affected	—
`b558275c1b040f0e5aa56c862241f9212b6118c3`	affected	—
`b9d9e8856f1c83e4277403f9b4c369b322ebcb12`	affected	—
`36a6d0f66c874666caf4e8be155b1be30f6231be`	affected	—
`5.10.181`	affected	< 5.10.248
`5.15.114`	affected	< 5.15.198
`6.1.29`	affected	< 6.1.160
`4.14.316`	affected	< 4.15
`4.19.284`	affected	< 4.20
`5.4.244`	affected	< 5.5
`6.2.16`	affected	< 6.3
`6.3.3`	affected	< 6.4

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`5.10.248`	unaffected	≤ 5.10.*
`5.15.198`	unaffected	≤ 5.15.*
`6.1.160`	unaffected	≤ 6.1.*
`6.6.120`	unaffected	≤ 6.6.*
`6.12.64`	unaffected	≤ 6.12.*
`6.18.3`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4475-1	linux security update
Debian DLA	DLA-4476-1	linux-6.1 security update
Debian DSA	DSA-6126-1	linux security update
Debian DSA	DSA-6127-1	linux security update
Ubuntu USN	USN-8177-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8179-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8177-2	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8183-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8184-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8179-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8185-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8183-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8203-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8204-1	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8185-2	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-4	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8245-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8257-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8258-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8260-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8261-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8265-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.234% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/1417927df8049a0194933861e9b098669a95c762
https://git.kernel.org/stable/c/3dd6d01384823e1bd8602873153d6fc4337ac4fe
https://git.kernel.org/stable/c/743cebcbd1b2609ec5057ab474979cef73d1b681
https://git.kernel.org/stable/c/837a23a11e0f734f096c7c7b0778d0e625e3dc87
https://git.kernel.org/stable/c/9c34a4a2ead00979d203a8c16bea87f0ef5291d8
https://git.kernel.org/stable/c/be0b613198e6bfa104ad520397cab82ad3ec1771
https://git.kernel.org/stable/c/c8f1d35076b78df61ace737e41cc1f4b7b63236c
https://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68773-bd5d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68773
https://www.cve.org/CVERecord?id=CVE-2025-68773

History

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Jan 19, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9c34a4a2ead00979d203a8c16bea87f0ef5291d8 https://git.kernel.org/stable/c/c8f1d35076b78df61ace737e41cc1f4b7b63236c

Jan 15, 2026 12:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68773-bd5d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68773 https://www.cve.org/CVERecord?id=CVE-2025-68773

Jan 13, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even.
Title		spi: fsl-cpm: Check length parity before switching to 16 bit mode
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1417927df8049a0194933861e9b098669a95c762 https://git.kernel.org/stable/c/3dd6d01384823e1bd8602873153d6fc4337ac4fe https://git.kernel.org/stable/c/743cebcbd1b2609ec5057ab474979cef73d1b681 https://git.kernel.org/stable/c/837a23a11e0f734f096c7c7b0778d0e625e3dc87 https://git.kernel.org/stable/c/be0b613198e6bfa104ad520397cab82ad3ec1771