Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-68773

spi: fsl-cpm: Check length parity before switching to 16 bit mode

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 60afe299bb541a928ba39bcb4ae8d3e428d1c5a5 to < c8f1d35076b78df61ace737e41cc1f4b7b63236caffected
  • 4badd33929c05ed314794b95f1af1308f7222be8 to < 9c34a4a2ead00979d203a8c16bea87f0ef5291d8affected
  • 7f6738e003b364783f3019fdf6e7645bc8dd1643 to < 837a23a11e0f734f096c7c7b0778d0e625e3dc87affected
  • fc96ec826bced75cc6b9c07a4ac44bbf651337ab to < 3dd6d01384823e1bd8602873153d6fc4337ac4feaffected
  • fc96ec826bced75cc6b9c07a4ac44bbf651337ab to < 743cebcbd1b2609ec5057ab474979cef73d1b681affected
  • fc96ec826bced75cc6b9c07a4ac44bbf651337ab to < be0b613198e6bfa104ad520397cab82ad3ec1771affected
  • fc96ec826bced75cc6b9c07a4ac44bbf651337ab to < 1417927df8049a0194933861e9b098669a95c762affected
  • 42c04316d9275ec267d36e5e9064cd56c9884148affected
  • dc120f2d35b030390a2bc0f94dd5f37e900cae91affected
  • b558275c1b040f0e5aa56c862241f9212b6118c3affected
  • b9d9e8856f1c83e4277403f9b4c369b322ebcb12affected
  • 36a6d0f66c874666caf4e8be155b1be30f6231beaffected
  • 5.10.181 to < 5.10.248affected
  • 5.15.114 to < 5.15.198affected
  • 6.1.29 to < 6.1.160affected
  • 4.14.316 to < 4.15affected
  • 4.19.284 to < 4.20affected
  • 5.4.244 to < 5.5affected
  • 6.2.16 to < 6.3affected
  • 6.3.3 to < 6.4affected

Linux Linux

Default version status: affected

  • 6.4affected
  • 0 to < 6.4unaffected
  • 5.10.248 to ≤ 5.10.*unaffected
  • 5.15.198 to ≤ 5.15.*unaffected
  • 6.1.160 to ≤ 6.1.*unaffected
  • 6.6.120 to ≤ 6.6.*unaffected
  • 6.12.64 to ≤ 6.12.*unaffected
  • 6.18.3 to ≤ 6.18.*unaffected
  • 6.19 to ≤ *unaffected

References