The Linux kernel's spi: ch341 driver contained a vulnerability (CVE-2025-68352) where the length used for copying data from the transmit buffer was calculated as min(32, trans->len + 1), including a 1-byte command header. This led to an out-of-bounds read from trans->tx_buf and a potential out-of-bounds write to ch341->tx_buf when the length reached the maximum packet size of 32 bytes. The fix involves copying len - 1 bytes instead, preventing buffer overflow and memory corruption.

This vulnerability can cause out-of-bounds memory reads and writes in kernel space, potentially leading to memory corruption, system instability, or privilege escalation. The CVSS 3.1 vector indicates local attack vector with low complexity and no user interaction, resulting in high confidentiality, integrity, and availability impacts.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the length of bytes copied in the ch341_transfer_one function. Users should apply the official kernel updates or patches that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the latest remediation guidance.