Linux Kernel CVE-2025-68352

In the Linux kernel, the following vulnerability has been resolved:

spi: ch341: fix out-of-bounds memory access in ch341_transfer_one

Discovered by Atuin - Automated Vulnerability Discovery Engine.

The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header.

When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because:

1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size

'trans->len', i.e., 'len - 1' in this context).

1. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is

CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer.

Fix this by copying 'len - 1' bytes.

The Linux kernel's spi-ch341 driver is affected on systems using the WCH CH341 USB-to-SPI bridge. No specific version range or CPE is provided in the source data; the fix is distributed across multiple stable trees as shown by the four git.kernel.org stable commits (545d1287e40a55242f6ab68bcc1ba3b74088b1bc, 81841da1f30f66a850cc8796d99ba330aad9d696, cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974, and ea1e43966cd03098fcd5f0d72e6c2901d45fa08d), indicating several maintained kernel branches received backports. Affected versions should be confirmed against each distribution's kernel changelog since exact introduced/fixed release tags are not enumerated in the provided intelligence.