CVE-2025-38425 (GCVE-0-2025-38425)

Vulnerability from cvelistv5 – Published: 2025-07-25 14:16 – Updated: 2026-08-05 12:01
VLAI
Title
i2c: tegra: check msg length in SMBUS block read
Summary
In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to read if the message length passed from the device is '0' or greater than the maximum allowed bytes.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d7583c8a57485da19feb6dd85573763a8c5ec1d1 , < c39d1a9ae4ad66afcecab124d7789722bfe909fa (git)
Affected: d7583c8a57485da19feb6dd85573763a8c5ec1d1 , < be5f6a65509cd5675362f15eb0440fb28b0f9d64 (git)
Affected: d7583c8a57485da19feb6dd85573763a8c5ec1d1 , < 75a864f21ceeb8c1e8ce1b7589174fec2c3a039e (git)
Affected: d7583c8a57485da19feb6dd85573763a8c5ec1d1 , < 3f03f77ce688d02da284174e1884b6065d6159bd (git)
Affected: d7583c8a57485da19feb6dd85573763a8c5ec1d1 , < a6e04f05ce0b070ab39d5775580e65c7d943da0b (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.95 , ≤ 6.6.* (semver)
Unaffected: 6.12.35 , ≤ 6.12.* (semver)
Unaffected: 6.15.4 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:55.331Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c39d1a9ae4ad66afcecab124d7789722bfe909fa",
              "status": "affected",
              "version": "d7583c8a57485da19feb6dd85573763a8c5ec1d1",
              "versionType": "git"
            },
            {
              "lessThan": "be5f6a65509cd5675362f15eb0440fb28b0f9d64",
              "status": "affected",
              "version": "d7583c8a57485da19feb6dd85573763a8c5ec1d1",
              "versionType": "git"
            },
            {
              "lessThan": "75a864f21ceeb8c1e8ce1b7589174fec2c3a039e",
              "status": "affected",
              "version": "d7583c8a57485da19feb6dd85573763a8c5ec1d1",
              "versionType": "git"
            },
            {
              "lessThan": "3f03f77ce688d02da284174e1884b6065d6159bd",
              "status": "affected",
              "version": "d7583c8a57485da19feb6dd85573763a8c5ec1d1",
              "versionType": "git"
            },
            {
              "lessThan": "a6e04f05ce0b070ab39d5775580e65c7d943da0b",
              "status": "affected",
              "version": "d7583c8a57485da19feb6dd85573763a8c5ec1d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-tegra.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.95",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.35",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: tegra: check msg length in SMBUS block read\n\nFor SMBUS block read, do not continue to read if the message length\npassed from the device is \u00270\u0027 or greater than the maximum allowed bytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is driven through `/dev/i2c-N` `I2C_RDWR`/`I2C_SMBUS` ioctls (or an in-kernel SMBus block read), which require local system access rather than a network path. `i2c-dev` performs no capability check, so the ioctl entry point is available to any local process holding the device node.\nAC:L - The attacker chooses the slave address and command byte, and any device that returns a first byte above 33 \u2014 extremely common (`0xFF` from an unimplemented register, or an on-board EEPROM the attacker can pre-write over the same interface) \u2014 triggers it deterministically on every attempt. There is no race, no timing window, and no reliance on memory layout the attacker cannot groom.\nPR:L - No capability or namespace privilege is checked anywhere on the path; the attacker only needs a local account with access to the i2c character device (typically supplementary group `i2c`, and world-accessible on many Tegra/Android/Jetson vendor images). Real root in the init namespace is not required.\nUI:N - The attacker performs the entire sequence with its own ioctl calls against the i2c device node. No victim action, mount, or file open is needed.\nS:U - The corruption occurs in kernel slab memory belonging to the same kernel security authority the attacker is already interacting with. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `i2cdev_ioctl_rdwr()` copies back the driver-inflated length, leaking up to ~220 bytes of adjacent kernel heap contents directly to userspace via `copy_to_user`. Combined with the slab overwrite primitive this yields effectively arbitrary kernel memory disclosure.\nI:H - Up to 255 bytes are written into a 34-byte `kmalloc-64` object, overflowing roughly 190\u2013220 bytes with contents fully controlled by the I2C device (which the attacker can supply or pre-program). That is a controlled-length, controlled-content slab overflow suitable for corrupting adjacent objects and hijacking control flow.\nA:H - Overwriting neighbouring slab objects reliably produces KASAN reports, slab corruption BUGs, and kernel panics even when exploitation for code execution fails. The unvalidated zero-length case additionally drives a degenerate transfer that stalls the controller."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:48.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c39d1a9ae4ad66afcecab124d7789722bfe909fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/be5f6a65509cd5675362f15eb0440fb28b0f9d64"
        },
        {
          "url": "https://git.kernel.org/stable/c/75a864f21ceeb8c1e8ce1b7589174fec2c3a039e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f03f77ce688d02da284174e1884b6065d6159bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6e04f05ce0b070ab39d5775580e65c7d943da0b"
        }
      ],
      "title": "i2c: tegra: check msg length in SMBUS block read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38425",
    "datePublished": "2025-07-25T14:16:45.661Z",
    "dateReserved": "2025-04-16T04:51:24.015Z",
    "dateUpdated": "2026-08-05T12:01:48.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38425",
      "date": "2026-08-05",
      "epss": "0.00164",
      "percentile": "0.06058"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38425\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T15:15:27.390\",\"lastModified\":\"2026-07-30T06:23:13.657\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni2c: tegra: check msg length in SMBUS block read\\n\\nFor SMBUS block read, do not continue to read if the message length\\npassed from the device is \u00270\u0027 or greater than the maximum allowed bytes.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: tegra: verificar la longitud del mensaje en la lectura del bloque SMBUS Para la lectura del bloque SMBUS, no contin\u00fae leyendo si la longitud del mensaje pasado desde el dispositivo es \u00270\u0027 o mayor que el m\u00e1ximo de bytes permitidos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/i2c/busses/i2c-tegra.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7583c8a57485da19feb6dd85573763a8c5ec1d1\",\"lessThan\":\"c39d1a9ae4ad66afcecab124d7789722bfe909fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7583c8a57485da19feb6dd85573763a8c5ec1d1\",\"lessThan\":\"be5f6a65509cd5675362f15eb0440fb28b0f9d64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7583c8a57485da19feb6dd85573763a8c5ec1d1\",\"lessThan\":\"75a864f21ceeb8c1e8ce1b7589174fec2c3a039e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7583c8a57485da19feb6dd85573763a8c5ec1d1\",\"lessThan\":\"3f03f77ce688d02da284174e1884b6065d6159bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7583c8a57485da19feb6dd85573763a8c5ec1d1\",\"lessThan\":\"a6e04f05ce0b070ab39d5775580e65c7d943da0b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/i2c/busses/i2c-tegra.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.95\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.35\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.4\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"20240234-C43A-430F-93FD-8F52CD666DE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.95\",\"matchCriteriaId\":\"C5E01853-7048-4D78-9479-9AEE41AC8456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.35\",\"matchCriteriaId\":\"E569FD34-0076-4428-BE17-EECCF867611C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.4\",\"matchCriteriaId\":\"DFD174C5-1AA2-4671-BDDC-1A9FCC753655\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f03f77ce688d02da284174e1884b6065d6159bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75a864f21ceeb8c1e8ce1b7589174fec2c3a039e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6e04f05ce0b070ab39d5775580e65c7d943da0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be5f6a65509cd5675362f15eb0440fb28b0f9d64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c39d1a9ae4ad66afcecab124d7789722bfe909fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:09:02+00:00",
      "cve": "CVE-2025-38425",
      "id": "CVE-2025-38425",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (i2c Tegra): Information disclosure or denial of service via SMBUS block read with invalid length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38425.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:46:24Z",
      "cve": "CVE-2025-38425",
      "id": "CVE-2025-38425",
      "initial_release_date": "2025-07-29T23:23:46Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "521",
      "product_status:known_not_affected": "196",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38425",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38425.json",
      "version": "41"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.