CVE-2025-68773spi: fsl-cpm: Check length parity before switching to 16 bit mode
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 60afe299bb541a928ba39bcb4ae8d3e428d1c5a5 before c8f1d35076b78df61ace737e41cc1f4b7b63236c; from 4badd33929c05ed314794b95f1af1308f7222be8 before 9c34a4a2ead00979d203a8c16bea87f0ef5291d8; from 7f6738e003b364783f3019fdf6e7645bc8dd1643 before 837a23a11e0f734f096c7c7b0778d0e625e3dc87; from fc96ec826bced75cc6b9c07a4ac44bbf651337ab before 3dd6d01384823e1bd8602873153d6fc4337ac4fe; from fc96ec826bced75cc6b9c07a4ac44bbf651337ab before 743cebcbd1b2609ec5057ab474979cef73d1b681; from fc96ec826bced75cc6b9c07a4ac44bbf651337ab before be0b613198e6bfa104ad520397cab82ad3ec1771; from fc96ec826bced75cc6b9c07a4ac44bbf651337ab before 1417927df8049a0194933861e9b098669a95c762; 42c04316d9275ec267d36e5e9064cd56c9884148; and 12 more ranges | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
References
- https://git.kernel.org/stable/c/c8f1d35076b78df61ace737e41cc1f4b7b63236c
- https://git.kernel.org/stable/c/9c34a4a2ead00979d203a8c16bea87f0ef5291d8
- https://git.kernel.org/stable/c/837a23a11e0f734f096c7c7b0778d0e625e3dc87
- https://git.kernel.org/stable/c/3dd6d01384823e1bd8602873153d6fc4337ac4fe
- https://git.kernel.org/stable/c/743cebcbd1b2609ec5057ab474979cef73d1b681
- https://git.kernel.org/stable/c/be0b613198e6bfa104ad520397cab82ad3ec1771
- https://git.kernel.org/stable/c/1417927df8049a0194933861e9b098669a95c762
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.