CVE-2025-68352
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
24/12/2025
Last modified:
29/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one<br />
<br />
Discovered by Atuin - Automated Vulnerability Discovery Engine.<br />
<br />
The &#39;len&#39; variable is calculated as &#39;min(32, trans->len + 1)&#39;,<br />
which includes the 1-byte command header.<br />
<br />
When copying data from &#39;trans->tx_buf&#39; to &#39;ch341->tx_buf + 1&#39;, using &#39;len&#39;<br />
as the length is incorrect because:<br />
<br />
1. It causes an out-of-bounds read from &#39;trans->tx_buf&#39; (which has size<br />
&#39;trans->len&#39;, i.e., &#39;len - 1&#39; in this context).<br />
2. It can cause an out-of-bounds write to &#39;ch341->tx_buf&#39; if &#39;len&#39; is<br />
CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1<br />
overflows the buffer.<br />
<br />
Fix this by copying &#39;len - 1&#39; bytes.