CVE-2025-68763 crypto: starfive - Correctly handle return of sg_nents_for_len
An integer overflow in the StarFive crypto driver mishandles error codes, potentially leading to buffer overflows and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68763?
CVE-2025-68763 is a vulnerability in Linux, published on 5 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: starfive - Correctly handle return of sg_nents_for_len
The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers.
Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows.
Which versions are affected by CVE-2025-68763?
How do I fix CVE-2025-68763?
Apply the vendor's patch.
Is CVE-2025-68763 being exploited?
There is no known exploitation of CVE-2025-68763 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68763, DEBIAN-CVE-2025-68763, GHSA-28vg-cxp3-45wq, ROOT-OS-DEBIAN-13-CVE-2025-68763, ROOT-OS-UBUNTU-2404-CVE-2025-68763, UBUNTU-CVE-2025-68763.