CVE-2025-68773

spi: fsl-cpm: Check length parity before switching to 16 bit mode

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: Oct 15, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: fsl-cpm: Check length parity before switching to 16 bit mode

Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM.

But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd.

Add the missing length parity verification and remain in 8 bit mode when the length is not even.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	60afe299bb541a928ba39bcb4ae8d3e428d1c5a5 to before c8f1d35076b78df61ace737e41cc1f4b7b63236cAffected 4badd33929c05ed314794b95f1af1308f7222be8 to before 9c34a4a2ead00979d203a8c16bea87f0ef5291d8Affected 7f6738e003b364783f3019fdf6e7645bc8dd1643 to before 837a23a11e0f734f096c7c7b0778d0e625e3dc87Affected fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 3dd6d01384823e1bd8602873153d6fc4337ac4feAffected fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 743cebcbd1b2609ec5057ab474979cef73d1b681Affected fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before be0b613198e6bfa104ad520397cab82ad3ec1771Affected fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 1417927df8049a0194933861e9b098669a95c762Affected 42c04316d9275ec267d36e5e9064cd56c9884148Affected dc120f2d35b030390a2bc0f94dd5f37e900cae91Affected b558275c1b040f0e5aa56c862241f9212b6118c3Affected b9d9e8856f1c83e4277403f9b4c369b322ebcb12Affected 36a6d0f66c874666caf4e8be155b1be30f6231beAffected 5.10.181 to before 5.10.248Affected 5.15.114 to before 5.15.198Affected 6.1.29 to before 6.1.160Affected 4.14.316 to before 4.15Affected 4.19.284 to before 4.20Affected 5.4.244 to before 5.5Affected 6.2.16 to before 6.3Affected 6.3.3 to before 6.4Affected
LinuxLinux	6.4Affected before 6.4Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

60afe299bb541a928ba39bcb4ae8d3e428d1c5a5 to before c8f1d35076b78df61ace737e41cc1f4b7b63236cAffected
4badd33929c05ed314794b95f1af1308f7222be8 to before 9c34a4a2ead00979d203a8c16bea87f0ef5291d8Affected
7f6738e003b364783f3019fdf6e7645bc8dd1643 to before 837a23a11e0f734f096c7c7b0778d0e625e3dc87Affected
fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 3dd6d01384823e1bd8602873153d6fc4337ac4feAffected
fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 743cebcbd1b2609ec5057ab474979cef73d1b681Affected
fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before be0b613198e6bfa104ad520397cab82ad3ec1771Affected
fc96ec826bced75cc6b9c07a4ac44bbf651337ab to before 1417927df8049a0194933861e9b098669a95c762Affected
42c04316d9275ec267d36e5e9064cd56c9884148Affected
dc120f2d35b030390a2bc0f94dd5f37e900cae91Affected
b558275c1b040f0e5aa56c862241f9212b6118c3Affected
b9d9e8856f1c83e4277403f9b4c369b322ebcb12Affected
36a6d0f66c874666caf4e8be155b1be30f6231beAffected
5.10.181 to before 5.10.248Affected
5.15.114 to before 5.15.198Affected
6.1.29 to before 6.1.160Affected
4.14.316 to before 4.15Affected
4.19.284 to before 4.20Affected
5.4.244 to before 5.5Affected
6.2.16 to before 6.3Affected
6.3.3 to before 6.4Affected

LinuxLinux

6.4Affected
before 6.4Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.