CVE-2025-38425

A flaw was found in the Linux kernel's i2c Tegra driver. A local attacker with high privileges could exploit this vulnerability by providing a specially crafted SMBUS (System Management Bus) block read message with an invalid length. This could lead to an out-of-bounds read, potentially resulting in information disclosure or a denial of service (DoS) on the system.

This vulnerability is rated as Moderate impact because exploitation is restricted to hardware platforms running NVIDIA Tegra SoCs and requires administrative privileges to execute arbitrary I2C bus read requests or physical access via a rogue peripheral. Enterprise environments operating on standard x86_64 or non-Tegra server architectures do not utilize this bus driver and are not exposed. If an invalid message length is supplied during an SMBus block read transaction, an out-of-bounds read occurs, potentially leading to denial of service or the leakage of kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.