CVE-2025-39869 (GCVE-0-2025-39869)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-08-05 12:05
VLAI
Title
dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 7d4de60d6db02d9b01d5890d5156b04fad65d07a (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < d722de80ce037dccf6931e778f4a46499d51bdf9 (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 301a96cc4dc006c9a285913d301e681cfbf7edb6 (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93 (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 1baed10553fc8b388351d8fc803e3ae6f1a863bc (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 069fd1688c57c0cc8a3de64d108579b31676f74b (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < d5e82f3f2c918d446df46e8d65f8083fd97cdec5 (git)
Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < e63419dbf2ceb083c1651852209c7f048089ac0f (git)
Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 5.4.300 , ≤ 5.4.* (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.153 , ≤ 6.1.* (semver)
Unaffected: 6.6.107 , ≤ 6.6.* (semver)
Unaffected: 6.12.48 , ≤ 6.12.* (semver)
Unaffected: 6.16.8 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:18.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d4de60d6db02d9b01d5890d5156b04fad65d07a",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d722de80ce037dccf6931e778f4a46499d51bdf9",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "301a96cc4dc006c9a285913d301e681cfbf7edb6",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "1baed10553fc8b388351d8fc803e3ae6f1a863bc",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "069fd1688c57c0cc8a3de64d108579b31676f74b",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "e63419dbf2ceb083c1651852209c7f048089ac0f",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\n\nFix a critical memory allocation bug in edma_setup_from_hw() where\nqueue_priority_map was allocated with insufficient memory. The code\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\nbut allocated memory using sizeof(s8) instead of the correct size.\n\nThis caused out-of-bounds memory writes when accessing:\n  queue_priority_map[i][0] = i;\n  queue_priority_map[i][1] = i;\n\nThe bug manifested as kernel crashes with \"Oops - undefined instruction\"\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\nmemory corruption triggered kernel hardening features on Clang.\n\nChange the allocation to use sizeof(*queue_priority_map) which\nautomatically gets the correct size for the 2D array structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `edma_setup_from_hw()` is reached only through the local driver model \u2014 device-tree platform probe of `ti,edma3`/`ti,edma3-tpcc` at boot, deferred-probe retries, sysfs bind/unbind of `edma`, module load, or the `edma_pm_resume()` late-resume callback. No network, adjacent-network, or remote-peer data reaches the path, and Local is the higher-severity of the two plausible readings versus Physical (DTB/board substitution).\nAC:L - The size error is unconditional \u2014 `sizeof(s8)` is always half of `sizeof(s8[2])`, so the buffer is always half the needed length, and no in-tree platform_data supplies `queue_priority_mapping` to take the early return. The overflow fires deterministically on every boot of every affected TI SoC with no race to win and no memory-layout precondition, and was reported as a reproducible probe-time Oops on BeagleBoard-X15.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the heap is corrupted by the kernel\u0027s own device-tree probe machinery during boot, before any user session exists, so the vulnerable state is reached with zero privileges. Deliberate re-triggering via sysfs bind/unbind or `rmmod`/`insmod` would need root, but that is not required for the corruption to arise (same basis as CVE-2025-39882 and CVE-2025-39930).\nUI:N - The EDMA platform driver binds automatically from the device tree during kernel boot and deferred-probe retries run unattended; `edma_pm_resume()` likewise runs on every system resume. No administrator or victim action, mount, file open, or device insertion is needed.\nS:U - The overflowed slab object, the adjacent kernel heap, and the EDMA MMIO window all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The `-1` terminator is itself written out of bounds, so once an intervening `devm_kcalloc()` in `edma_probe()` reclaims or zeroes that byte, `for (i = 0; queue_priority_mapping[i][0] != -1; i++)` walks kernel heap without bound, reading arbitrary adjacent slab contents and pushing them into the EDMA `QUEPRI` register \u2014 an unbounded out-of-bounds read with an observable exfiltration channel, and the resulting hardened-kernel splat leaks kernel pointers and a full stack trace.\nI:H - This is a slab out-of-bounds write past a `devm_kcalloc()` allocation, corrupting adjacent heap contents (including device-tree-supplied `ti,tptcs` priority values written through the undersized buffer at `edma_probe():2474`), and out-of-bounds heap writes of this class are the classic basis for heap-grooming-based write primitives. The follow-on `edma_assign_priority_to_queue()` shift-by-up-to-508 further writes heap-derived garbage into hardware registers, corrupting DMA-engine queue arbitration for all downstream consumers.\nA:H - The overflow was reported to crash the kernel outright with \"Oops - undefined instruction\" during EDMA probe on BeagleBoard-X15 under Clang hardening, and the unterminated consumer loop can spin over the heap issuing MMIO writes. On these boards EDMA is required for MMC, SPI, audio and network DMA, so a probe-time panic or corrupted queue configuration renders the system unbootable or unusable, and `edma_pm_resume()` reproduces it on every resume."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:47.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f"
        }
      ],
      "title": "dmaengine: ti: edma: Fix memory allocation size for queue_priority_map",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39869",
    "datePublished": "2025-09-23T06:00:43.852Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-08-05T12:05:47.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39869",
      "date": "2026-08-05",
      "epss": "0.00149",
      "percentile": "0.04625"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39869\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-23T06:15:46.097\",\"lastModified\":\"2026-07-30T06:23:53.003\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\\n\\nFix a critical memory allocation bug in edma_setup_from_hw() where\\nqueue_priority_map was allocated with insufficient memory. The code\\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\\nbut allocated memory using sizeof(s8) instead of the correct size.\\n\\nThis caused out-of-bounds memory writes when accessing:\\n  queue_priority_map[i][0] = i;\\n  queue_priority_map[i][1] = i;\\n\\nThe bug manifested as kernel crashes with \\\"Oops - undefined instruction\\\"\\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\\nmemory corruption triggered kernel hardening features on Clang.\\n\\nChange the allocation to use sizeof(*queue_priority_map) which\\nautomatically gets the correct size for the 2D array structure.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/ti/edma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"7d4de60d6db02d9b01d5890d5156b04fad65d07a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"d722de80ce037dccf6931e778f4a46499d51bdf9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"301a96cc4dc006c9a285913d301e681cfbf7edb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"1baed10553fc8b388351d8fc803e3ae6f1a863bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"069fd1688c57c0cc8a3de64d108579b31676f74b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"d5e82f3f2c918d446df46e8d65f8083fd97cdec5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b6b3b7420190888793c49e97276e1e73bd7eaed\",\"lessThan\":\"e63419dbf2ceb083c1651852209c7f048089ac0f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/ti/edma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.300\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.153\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.107\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.48\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.8\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4\",\"versionEndExcluding\":\"5.4.300\",\"matchCriteriaId\":\"403BB92A-1ABA-4222-BF23-C3F184ADBEC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.245\",\"matchCriteriaId\":\"B0E443AF-02FC-45A1-9CD7-3F80A65F1A15\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.194\",\"matchCriteriaId\":\"CF862263-DC8D-4324-A52A-DA1D7880B35A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.153\",\"matchCriteriaId\":\"39B3B4F7-FA64-4E7C-B55D-53A5D004A639\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.107\",\"matchCriteriaId\":\"D273EDA6-2CFE-4EBD-B024-62EB057830F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.48\",\"matchCriteriaId\":\"9652E701-5C8E-49CF-89A5-499E214A5902\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.8\",\"matchCriteriaId\":\"8DA00A4E-AABB-4A69-AB39-67B22D0B36D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"47E4C5C0-079F-4838-971B-8C503D48FCC2\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:09+00:00",
      "cve": "CVE-2025-39869",
      "id": "CVE-2025-39869",
      "initial_release_date": "2025-09-23T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39869.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.