CVE-2025-38380: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38380 is an initialization issue in the Linux kernel's I2C Designware driver that could allow an out-of-bounds access of the msgs array. The vulnerability exists because amd_i2c_dw_xfer_quirk() initializes msgs and msgs_num but fails to initialize msg_write_idx before calling i2c_dw_xfer_init(), which requires all three to be set. It was published on July 25, 2025, and has since been rejected/withdrawn by its CVE Numbering Authority. The associated CVSS v3.1 score (assigned by Red Hat prior to rejection) was 5.5 (Medium), reflecting a local, low-privilege attack with high availability impact (Red Hat CVE, Red Hat Bugzilla).

The root cause is an improper initialization (CWE-665) in the AMD-specific I2C Designware transfer quirk path. Specifically, amd_i2c_dw_xfer_quirk() sets msgs and msgs_num in the device context but leaves msg_write_idx uninitialized, which can hold an arbitrary stale value. When i2c_dw_xfer_init() subsequently uses msg_write_idx as an index into the msgs array, an out-of-bounds memory access may occur. The fix involves initializing msg_write_idx to zero before the call to i2c_dw_xfer_init(). Patches were applied across multiple stable kernel branches (5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.15.x) (Red Hat Bugzilla).

Exploitation of this vulnerability could cause system instability, kernel crashes, or unexpected behavior due to the out-of-bounds memory access in the I2C subsystem. The primary impact is on availability (denial of service), with no direct confidentiality or integrity impact identified. The scope is limited to the local system, and the vulnerability requires low-privileged local access to trigger (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for this vulnerability. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The CVE has been rejected/withdrawn by its numbering authority, further reducing its operational significance. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat CVE).

Patches addressing this initialization issue have been applied to multiple Linux stable kernel branches: 5.15.187, 6.1.144, 6.6.97, 6.12.37, 6.15.6, and 6.16-rc5. Red Hat has issued several errata (e.g., RHSA-2025:13776, RHSA-2025:13962, RHSA-2025:14003, RHSA-2025:14054, RHSA-2025:14082, RHSA-2025:14418, RHSA-2025:16538, RHSA-2025:16539, RHSA-2025:16580) for affected RHEL versions. The recommended remediation is to update to a patched kernel version; as an interim measure, limiting local user access on systems with AMD I2C hardware reduces exposure (Red Hat CVE, Red Hat Bugzilla).