CVE-2025-68773 spi: fsl-cpm: Check length parity before switching to 16 bit mode
A buffer overrun in the Linux kernel fsl-cpm SPI driver allows local attackers to cause denial of service or potentially execute code via odd-sized transfers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68773?
CVE-2025-68773 is a memory corruption vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: fsl-cpm: Check length parity before switching to 16 bit mode
Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM.
But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd.
Add the missing length parity verification and remain in 8 bit mode when the length is not even.
Which versions are affected by CVE-2025-68773?
How do I fix CVE-2025-68773?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68773 being exploited?
There is no known exploitation of CVE-2025-68773 in the wild and no public exploit code.
Sources
Also known as AZL-74414, BELL-CVE-2025-68773, DEBIAN-CVE-2025-68773, GHSA-wrfv-x882-24r3, ROOT-OS-DEBIAN-11-CVE-2025-68773, ROOT-OS-DEBIAN-12-CVE-2025-68773 and 3 more.