CVE-2025-68352spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8846739f52afa07e63395c80227dc544f54bd7b1 before cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974; from 8846739f52afa07e63395c80227dc544f54bd7b1 before ea1e43966cd03098fcd5f0d72e6c2901d45fa08d; 8846739f52afa07e63395c80227dc544f54bd7b1 builds before 81841da1f30f66a850cc8796d99ba330aad9d696; 8846739f52afa07e63395c80227dc544f54bd7b1 builds before 545d1287e40a55242f6ab68bcc1ba3b74088b1bc | CNA record |
References
- https://git.kernel.org/stable/c/cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974
- https://git.kernel.org/stable/c/ea1e43966cd03098fcd5f0d72e6c2901d45fa08d
- https://git.kernel.org/stable/c/81841da1f30f66a850cc8796d99ba330aad9d696
- https://git.kernel.org/stable/c/545d1287e40a55242f6ab68bcc1ba3b74088b1bc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.