Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s NVIDIA Tegra I2C driver can mishandle an invalid SMBus block-read length supplied by a device. Continuing with a zero or oversized length may compromise confidentiality, integrity, or availability. Exploitation requires local access according to the supplied CVSS assessment, so affected Tegra systems should receive an expedited kernel update.
Executive priority
Treat this as a high-priority maintenance issue for confirmed Tegra deployments, especially where local users or peripherals are not fully trusted. It is less urgent for systems without Tegra I2C exposure. There is no supplied evidence of active exploitation, but the potential impact spans data confidentiality, integrity, and system availability.
Technical view
The Tegra I2C SMBus block-read path failed to reject a device-reported message length of zero or greater than the protocol maximum. The Linux fix adds length validation before reading continues. The record assigns CVSS 3.1 score 7.8 with local, low-complexity, low-privilege access, no user interaction, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is limited to Linux systems using the Tegra I2C driver and an affected kernel revision. The supplied version data includes 5.18, 6.1.142, 6.6.95, 6.12.35, 6.15.4, and 6.16, but its range semantics are incomplete. Confirm status through the applicable distribution or device-vendor advisory.
Exploitation context
The supplied CVSS vector describes local exploitation requiring low privileges and no user interaction. The vulnerable condition involves an invalid length received from an SMBus device. The source bundle does not establish public exploit availability or active exploitation, and the CVE is not identified as KEV.
Researcher notes
The record provides no CWE and does not describe the precise memory-safety consequence or proven exploitation primitive. Version entries include an ambiguous “0” and do not clearly express ranges. Researchers and vulnerability managers should map the referenced stable commits to distribution kernels rather than relying solely on the raw version list.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution and device-vendor advisories for corrected package versions.
- Prioritize Tegra systems that expose SMBus operations to less-trusted local users or devices.
- Restrict local access and untrusted peripheral attachment until updates are applied.
Validation and detection
- Inventory Linux systems using NVIDIA Tegra hardware and the Tegra I2C driver.
- Record each running kernel and compare it with vendor-published affected and fixed versions.
- Confirm the installed kernel incorporates the applicable referenced stable commit.
- After updating, verify the corrected kernel is running and the system operates normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38425 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c39d1a9ae4ad66afcecab124d7789722bfe909faCVE reference, Linux
- https://git.kernel.org/stable/c/be5f6a65509cd5675362f15eb0440fb28b0f9d64CVE reference, Linux
- https://git.kernel.org/stable/c/75a864f21ceeb8c1e8ce1b7589174fec2c3a039eCVE reference, Linux
- https://git.kernel.org/stable/c/3f03f77ce688d02da284174e1884b6065d6159bdCVE reference, Linux
- https://git.kernel.org/stable/c/a6e04f05ce0b070ab39d5775580e65c7d943da0bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.