Initialization Issue in Linux Kernel's I2C Designware Product

CVE-2025-38380

What is CVE-2025-38380?

A vulnerability in the Linux kernel's I2C Designware subsystem arises from an initialization oversight. Specifically, the function i2c_dw_xfer_init() relies on properly initialized parameters, but msg_write_idx was not set prior to invoking this function. This oversight can lead to out-of-bounds access of the msgs array, potentially causing unexpected behavior or data corruption. A fix has been implemented to ensure msg_write_idx is initialized correctly, preventing the occurrence of this vulnerability.

References