Answer in brief
CVE-2025-68773 records a Unknown severity vulnerability in spi: fsl-cpm: Check length parity before switching to 16 bit mode. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=60afe299bb541a928ba39bcb4ae8d3e428d1c5a5 <c8f1d35076b78df61ace737e41cc1f4b7b63236c || >=4badd33929c05ed314794b95f1af1308f7222be8 <9c34a4a2ead00979d203a8c16bea87f0ef5291d8 || >=7f6738e003b364783f3019fdf6e7645bc8dd1643 <837a23a11e0f734f096c7c7b0778d0e625e3dc87 || >=fc96ec826bced75cc6b9c07a4ac44bbf651337ab <3dd6d01384823e1bd8602873153d6fc4337ac4fe || >=fc96ec826bced75cc6b9c07a4ac44bbf651337ab <743cebcbd1b2609ec5057ab474979cef73d1b681 || >=fc96ec826bced75cc6b9c07a4ac44bbf651337ab <be0b613198e6bfa104ad520397cab82ad3ec1771 || >=fc96ec826bced75cc6b9c07a4ac44bbf651337ab <1417927df8049a0194933861e9b098669a95c762 || 42c04316d9275ec267d36e5e9064cd56c9884148 || dc120f2d35b030390a2bc0f94dd5f37e900cae91 || b558275c1b040f0e5aa56c862241f9212b6118c3 || b9d9e8856f1c83e4277403f9b4c369b322ebcb12 || 36a6d0f66c874666caf4e8be155b1be30f6231be || >=5.10.181 <5.10.248 || >=5.15.114 <5.15.198 || >=6.1.29 <6.1.160 || >=4.14.316 <4.15 || >=4.19.284 <4.20 || >=5.4.244 <5.5 || >=6.2.16 <6.3 || >=6.3.3 <6.4 | c8f1d35076b78df61ace737e41cc1f4b7b63236c, 9c34a4a2ead00979d203a8c16bea87f0ef5291d8, 837a23a11e0f734f096c7c7b0778d0e625e3dc87, 3dd6d01384823e1bd8602873153d6fc4337ac4fe, 743cebcbd1b2609ec5057ab474979cef73d1b681, be0b613198e6bfa104ad520397cab82ad3ec1771, 1417927df8049a0194933861e9b098669a95c762, 5.10.248, 5.15.198, 6.1.160, 4.15, 4.20, 5.5, 6.3, 6.4 |
| Linux/Linuxgeneric | 6.4 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.7 <* | * |
Published upstream
Jan 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("spi: fsl-cpm: Use 16 bit mode for large transfers with even size") failed to make sure that the size is really even before switching to 16 bit mode. Until recently the problem went unnoticed because kernfs uses a pre-allocated bounce buffer of size PAGE_SIZE for reading EEPROM. But commit 8ad6249c51d0 ("eeprom: at25: convert to spi-mem API") introduced an additional dynamically allocated bounce buffer whose size is exactly the size of the transfer, leading to a buffer overrun in the fsl-cpm driver when that size is odd. Add the missing length parity verification and remain in 8 bit mode when the length is not even.
Quoted source text, attributed separately from HOL analysis.