Critical Vulnerability in Linux Kernel: SMBUS Block Read Message Length Check
Summary
CVE-2025-38425: In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to read if the message length passed from the device is '0' or gr... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the SMBUS block read functionality, which is crucial for communication between devices on the system bus.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the i2c subsystem, specifically within the tegra driver. The issue arises during SMBUS block read operations, where the kernel fails to validate the message length received from the device. If the length is '0' or exceeds the maximum allowed bytes, the kernel should not proceed with the read operation. This oversight could lead to unexpected behavior, including potential system crashes or data corruption, posing a significant risk to system stability and security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The CVE-2025-38425 vulnerability in the Linux kernel poses significant risks related to SMBUS block read operations. It is essential for users and administrators to stay informed about this issue and apply the necessary updates to ensure system security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38425 is a vulnerability in the Linux kernel related to the SMBUS block read functionality, where message length checks are not properly enforced.
This vulnerability can lead to system instability, crashes, or data corruption if exploited, particularly during SMBUS block read operations.
Debian versions 11, 12, and 13 are affected by this vulnerability. It is crucial to check for updates and apply patches as they become available.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
