CVE-2025-68237

The vulnerability resides in the mtdchar driver's handling of read and write ioctl commands. The user-supplied req.start and req.len fields are both 64-bit unsigned integers (u64). While req.len is masked to 32 bits, capping it at U32_MAX, req.start can be as large as U64_MAX. The addition start + len is performed without overflow checking, leading to possible integer wrap-around.

To trigger the overflow, an attacker must have access to an MTD character device (e.g., /dev/mtd*) and the ability to issue the relevant ioctl calls. No authentication beyond file access is needed. By providing a large start value, the subsequent offset calculation wraps, potentially causing the driver to read or write to a memory region outside the intended MTD partition.

Successful exploitation could allow an attacker to read sensitive kernel memory or corrupt data within the device's memory space. This could lead to information disclosure, privilege escalation, or denial of service. The exact impact depends on the kernel configuration and the specific MTD device.

The fix, introduced in Linux kernel stable updates, adds a check_add_overflow() call before the addition to safely detect and handle overflow conditions. Patches are available for affected stable kernels [1][2]. Users should update their kernel to a version containing the fix.