Vulnerability-Lookup

FKIE_CVE-2025-39869

Vulnerability from fkie_nvd - Published: 2025-09-23 06:15 - Updated: 2026-10-19 21:10

Severity

8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	Mailing List, Third Party Advisory

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
debian	debian_linux	11.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d4de60d6db02d9b01d5890d5156b04fad65d07a",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d722de80ce037dccf6931e778f4a46499d51bdf9",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "301a96cc4dc006c9a285913d301e681cfbf7edb6",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "1baed10553fc8b388351d8fc803e3ae6f1a863bc",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "069fd1688c57c0cc8a3de64d108579b31676f74b",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "e63419dbf2ceb083c1651852209c7f048089ac0f",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "403BB92A-1ABA-4222-BF23-C3F184ADBEC5",
              "versionEndExcluding": "5.4.300",
              "versionStartIncluding": "4.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0E443AF-02FC-45A1-9CD7-3F80A65F1A15",
              "versionEndExcluding": "5.10.245",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF862263-DC8D-4324-A52A-DA1D7880B35A",
              "versionEndExcluding": "5.15.194",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "39B3B4F7-FA64-4E7C-B55D-53A5D004A639",
              "versionEndExcluding": "6.1.153",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D273EDA6-2CFE-4EBD-B024-62EB057830F3",
              "versionEndExcluding": "6.6.107",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9652E701-5C8E-49CF-89A5-499E214A5902",
              "versionEndExcluding": "6.12.48",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DA00A4E-AABB-4A69-AB39-67B22D0B36D2",
              "versionEndExcluding": "6.16.8",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\n\nFix a critical memory allocation bug in edma_setup_from_hw() where\nqueue_priority_map was allocated with insufficient memory. The code\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\nbut allocated memory using sizeof(s8) instead of the correct size.\n\nThis caused out-of-bounds memory writes when accessing:\n  queue_priority_map[i][0] = i;\n  queue_priority_map[i][1] = i;\n\nThe bug manifested as kernel crashes with \"Oops - undefined instruction\"\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\nmemory corruption triggered kernel hardening features on Clang.\n\nChange the allocation to use sizeof(*queue_priority_map) which\nautomatically gets the correct size for the 2D array structure."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: ti: edma: Corregir el tama\u00f1o de asignaci\u00f3n de memoria para queue_priority_map\n\nCorregir un error cr\u00edtico de asignaci\u00f3n de memoria en edma_setup_from_hw() donde queue_priority_map fue asignado con memoria insuficiente. El c\u00f3digo declar\u00f3 queue_priority_map como s8 (*)[2] (puntero a un array de 2 s8), pero asign\u00f3 memoria usando sizeof(s8) en lugar del tama\u00f1o correcto.\n\nEsto caus\u00f3 escrituras de memoria fuera de l\u00edmites al acceder a:\nqueue_priority_map[i][0] = i;\nqueue_priority_map[i][1] = i;\n\nEl error se manifest\u00f3 como fallos del kernel con \u0027Oops - undefined instruction\u0027 en plataformas ARM (BeagleBoard-X15) durante la sonda del controlador EDMA, ya que la corrupci\u00f3n de memoria activ\u00f3 caracter\u00edsticas de endurecimiento del kernel en Clang.\n\nCambiar la asignaci\u00f3n para usar sizeof(*queue_priority_map) lo que obtiene autom\u00e1ticamente el tama\u00f1o correcto para la estructura del array 2D."
    }
  ],
  "id": "CVE-2025-39869",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-09-23T06:15:46.097",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-39869 (GCVE-0-2025-39869)

Vulnerability from cvelistv5 – Published: 2025-09-23 06:00 – Updated: 2026-08-05 12:05

Title

dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

Summary

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6637 records in the last 180 days details

References

9 references

URL	Tags
https://git.kernel.org/stable/c/7d4de60d6db02d9b0…
https://git.kernel.org/stable/c/d722de80ce037dccf…
https://git.kernel.org/stable/c/301a96cc4dc006c9a…
https://git.kernel.org/stable/c/5e462fa0dfdb52b39…
https://git.kernel.org/stable/c/1baed10553fc8b388…
https://git.kernel.org/stable/c/069fd1688c57c0cc8…
https://git.kernel.org/stable/c/d5e82f3f2c918d446…
https://git.kernel.org/stable/c/e63419dbf2ceb083c…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 7d4de60d6db02d9b01d5890d5156b04fad65d07a (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < d722de80ce037dccf6931e778f4a46499d51bdf9 (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 301a96cc4dc006c9a285913d301e681cfbf7edb6 (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93 (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 1baed10553fc8b388351d8fc803e3ae6f1a863bc (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < 069fd1688c57c0cc8a3de64d108579b31676f74b (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < d5e82f3f2c918d446df46e8d65f8083fd97cdec5 (git) Affected: 2b6b3b7420190888793c49e97276e1e73bd7eaed , < e63419dbf2ceb083c1651852209c7f048089ac0f (git)
Linux	Linux	Affected: 4.4 Unaffected: 0 , < 4.4 (semver) Unaffected: 5.4.300 , ≤ 5.4.* (semver) Unaffected: 5.10.245 , ≤ 5.10.* (semver) Unaffected: 5.15.194 , ≤ 5.15.* (semver) Unaffected: 6.1.153 , ≤ 6.1.* (semver) Unaffected: 6.6.107 , ≤ 6.6.* (semver) Unaffected: 6.12.48 , ≤ 6.12.* (semver) Unaffected: 6.16.8 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:18.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d4de60d6db02d9b01d5890d5156b04fad65d07a",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d722de80ce037dccf6931e778f4a46499d51bdf9",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "301a96cc4dc006c9a285913d301e681cfbf7edb6",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "1baed10553fc8b388351d8fc803e3ae6f1a863bc",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "069fd1688c57c0cc8a3de64d108579b31676f74b",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "e63419dbf2ceb083c1651852209c7f048089ac0f",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\n\nFix a critical memory allocation bug in edma_setup_from_hw() where\nqueue_priority_map was allocated with insufficient memory. The code\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\nbut allocated memory using sizeof(s8) instead of the correct size.\n\nThis caused out-of-bounds memory writes when accessing:\n  queue_priority_map[i][0] = i;\n  queue_priority_map[i][1] = i;\n\nThe bug manifested as kernel crashes with \"Oops - undefined instruction\"\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\nmemory corruption triggered kernel hardening features on Clang.\n\nChange the allocation to use sizeof(*queue_priority_map) which\nautomatically gets the correct size for the 2D array structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `edma_setup_from_hw()` is reached only through the local driver model \u2014 device-tree platform probe of `ti,edma3`/`ti,edma3-tpcc` at boot, deferred-probe retries, sysfs bind/unbind of `edma`, module load, or the `edma_pm_resume()` late-resume callback. No network, adjacent-network, or remote-peer data reaches the path, and Local is the higher-severity of the two plausible readings versus Physical (DTB/board substitution).\nAC:L - The size error is unconditional \u2014 `sizeof(s8)` is always half of `sizeof(s8[2])`, so the buffer is always half the needed length, and no in-tree platform_data supplies `queue_priority_mapping` to take the early return. The overflow fires deterministically on every boot of every affected TI SoC with no race to win and no memory-layout precondition, and was reported as a reproducible probe-time Oops on BeagleBoard-X15.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the heap is corrupted by the kernel\u0027s own device-tree probe machinery during boot, before any user session exists, so the vulnerable state is reached with zero privileges. Deliberate re-triggering via sysfs bind/unbind or `rmmod`/`insmod` would need root, but that is not required for the corruption to arise (same basis as CVE-2025-39882 and CVE-2025-39930).\nUI:N - The EDMA platform driver binds automatically from the device tree during kernel boot and deferred-probe retries run unattended; `edma_pm_resume()` likewise runs on every system resume. No administrator or victim action, mount, file open, or device insertion is needed.\nS:U - The overflowed slab object, the adjacent kernel heap, and the EDMA MMIO window all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The `-1` terminator is itself written out of bounds, so once an intervening `devm_kcalloc()` in `edma_probe()` reclaims or zeroes that byte, `for (i = 0; queue_priority_mapping[i][0] != -1; i++)` walks kernel heap without bound, reading arbitrary adjacent slab contents and pushing them into the EDMA `QUEPRI` register \u2014 an unbounded out-of-bounds read with an observable exfiltration channel, and the resulting hardened-kernel splat leaks kernel pointers and a full stack trace.\nI:H - This is a slab out-of-bounds write past a `devm_kcalloc()` allocation, corrupting adjacent heap contents (including device-tree-supplied `ti,tptcs` priority values written through the undersized buffer at `edma_probe():2474`), and out-of-bounds heap writes of this class are the classic basis for heap-grooming-based write primitives. The follow-on `edma_assign_priority_to_queue()` shift-by-up-to-508 further writes heap-derived garbage into hardware registers, corrupting DMA-engine queue arbitration for all downstream consumers.\nA:H - The overflow was reported to crash the kernel outright with \"Oops - undefined instruction\" during EDMA probe on BeagleBoard-X15 under Clang hardening, and the unterminated consumer loop can spin over the heap issuing MMIO writes. On these boards EDMA is required for MMC, SPI, audio and network DMA, so a probe-time panic or corrupted queue configuration renders the system unbootable or unusable, and `edma_pm_resume()` reproduces it on every resume."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:47.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f"
        }
      ],
      "title": "dmaengine: ti: edma: Fix memory allocation size for queue_priority_map",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39869",
    "datePublished": "2025-09-23T06:00:43.852Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-08-05T12:05:47.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted