CVE-2025-68352: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68352 is an out-of-bounds memory access vulnerability in the Linux kernel's SPI CH341 driver, specifically within the ch341_transfer_one function. The flaw was discovered by the Atuin Automated Vulnerability Discovery Engine and publicly disclosed on December 24, 2025. It affects Linux kernel versions starting from 6.11, with patches available for stable branches including 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Feedly estimates the severity as HIGH, though no official CVSS score has been assigned at this time (Red Hat CVE, Red Hat Bugzilla).

The root cause is an off-by-one error in buffer length calculation (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the ch341_transfer_one function of the spi/ch341 driver. The len variable is computed as min(32, trans->len + 1) to account for a 1-byte command header, but this value is then incorrectly used as the copy length when transferring data from trans->tx_buf to ch341->tx_buf + 1. This results in two distinct issues: (1) an out-of-bounds read from trans->tx_buf, which has a valid size of only len - 1 bytes, and (2) an out-of-bounds write to ch341->tx_buf when len equals CH341_PACKET_LENGTH (32), causing a one-byte buffer overflow. The fix corrects the copy operation to use len - 1 bytes (Red Hat Bugzilla).

Successful exploitation of this vulnerability could lead to system instability, kernel crashes, or potentially arbitrary code execution in kernel context, depending on memory layout at the time of exploitation. The out-of-bounds read may expose sensitive kernel memory contents, while the out-of-bounds write could corrupt adjacent kernel data structures, compromising system integrity and availability. The vulnerability is confined to systems using the CH341 USB-to-SPI adapter driver, limiting the affected asset scope to hosts with this hardware or driver loaded (Red Hat CVE).

The primary remediation is to update to a patched Linux kernel version. Fixes have been backported to the following stable releases: 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. The patch corrects the memcpy call in ch341_transfer_one to copy len - 1 bytes instead of len. As a workaround on systems where the CH341 SPI driver is not required, administrators can blacklist or unload the spi-ch341 kernel module to eliminate exposure. Kernel updates should be prioritized on systems using CH341 USB-to-SPI adapters (Red Hat Bugzilla, Red Hat CVE).