CVE-2025-68777: Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
In the Linux kernel, the following vulnerability has been resolved:
Input: tiam335xtsc - fix off-by-one error in wireorder validation
The current validation 'wireorder[i] > ARRAYSIZE(configpins)' allows wireorder[i] to equal ARRAYSIZE(configpins), which causes out-of-bounds access when used as index in 'configpins[wireorder[i]]'.
Since configpins has 4 elements (indices 0-3), the valid range for wireorder should be 0-3. Fix the off-by-one error by using >= instead of > in the validation check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Change the validation check from 'wire_order[i] > ARRAY_SIZE(config_pins)' to 'wire_order[i] >= ARRAY_SIZE(config_pins)' so wire_order values are limited to 0-3.
Linux kernel Input: ti_am335x_tsc wire_order validation = wire_order[i] >= ARRAY_SIZE(config_pins)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68777?
CVE-2025-68777 is classified as a medium severity vulnerability due to its potential to cause input validation issues.
How do I fix CVE-2025-68777?
To fix CVE-2025-68777, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-68777?
CVE-2025-68777 primarily affects the Linux kernel, particularly systems utilizing the ti_am335x_tsc driver.
What are the potential impacts of CVE-2025-68777?
CVE-2025-68777 can lead to the exploitation of off-by-one errors, potentially compromising system integrity.
When was CVE-2025-68777 disclosed?
CVE-2025-68777 was disclosed in 2025, highlighting a validation error in the wire_order parameter.