{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:18.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d4de60d6db02d9b01d5890d5156b04fad65d07a",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d722de80ce037dccf6931e778f4a46499d51bdf9",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "301a96cc4dc006c9a285913d301e681cfbf7edb6",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "1baed10553fc8b388351d8fc803e3ae6f1a863bc",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "069fd1688c57c0cc8a3de64d108579b31676f74b",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            },
            {
              "lessThan": "e63419dbf2ceb083c1651852209c7f048089ac0f",
              "status": "affected",
              "version": "2b6b3b7420190888793c49e97276e1e73bd7eaed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/ti/edma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.300",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.153",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\n\nFix a critical memory allocation bug in edma_setup_from_hw() where\nqueue_priority_map was allocated with insufficient memory. The code\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\nbut allocated memory using sizeof(s8) instead of the correct size.\n\nThis caused out-of-bounds memory writes when accessing:\n  queue_priority_map[i][0] = i;\n  queue_priority_map[i][1] = i;\n\nThe bug manifested as kernel crashes with \"Oops - undefined instruction\"\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\nmemory corruption triggered kernel hardening features on Clang.\n\nChange the allocation to use sizeof(*queue_priority_map) which\nautomatically gets the correct size for the 2D array structure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `edma_setup_from_hw()` is reached only through the local driver model \u2014 device-tree platform probe of `ti,edma3`/`ti,edma3-tpcc` at boot, deferred-probe retries, sysfs bind/unbind of `edma`, module load, or the `edma_pm_resume()` late-resume callback. No network, adjacent-network, or remote-peer data reaches the path, and Local is the higher-severity of the two plausible readings versus Physical (DTB/board substitution).\nAC:L - The size error is unconditional \u2014 `sizeof(s8)` is always half of `sizeof(s8[2])`, so the buffer is always half the needed length, and no in-tree platform_data supplies `queue_priority_mapping` to take the early return. The overflow fires deterministically on every boot of every affected TI SoC with no race to win and no memory-layout precondition, and was reported as a reproducible probe-time Oops on BeagleBoard-X15.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the heap is corrupted by the kernel\u0027s own device-tree probe machinery during boot, before any user session exists, so the vulnerable state is reached with zero privileges. Deliberate re-triggering via sysfs bind/unbind or `rmmod`/`insmod` would need root, but that is not required for the corruption to arise (same basis as CVE-2025-39882 and CVE-2025-39930).\nUI:N - The EDMA platform driver binds automatically from the device tree during kernel boot and deferred-probe retries run unattended; `edma_pm_resume()` likewise runs on every system resume. No administrator or victim action, mount, file open, or device insertion is needed.\nS:U - The overflowed slab object, the adjacent kernel heap, and the EDMA MMIO window all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The `-1` terminator is itself written out of bounds, so once an intervening `devm_kcalloc()` in `edma_probe()` reclaims or zeroes that byte, `for (i = 0; queue_priority_mapping[i][0] != -1; i++)` walks kernel heap without bound, reading arbitrary adjacent slab contents and pushing them into the EDMA `QUEPRI` register \u2014 an unbounded out-of-bounds read with an observable exfiltration channel, and the resulting hardened-kernel splat leaks kernel pointers and a full stack trace.\nI:H - This is a slab out-of-bounds write past a `devm_kcalloc()` allocation, corrupting adjacent heap contents (including device-tree-supplied `ti,tptcs` priority values written through the undersized buffer at `edma_probe():2474`), and out-of-bounds heap writes of this class are the classic basis for heap-grooming-based write primitives. The follow-on `edma_assign_priority_to_queue()` shift-by-up-to-508 further writes heap-derived garbage into hardware registers, corrupting DMA-engine queue arbitration for all downstream consumers.\nA:H - The overflow was reported to crash the kernel outright with \"Oops - undefined instruction\" during EDMA probe on BeagleBoard-X15 under Clang hardening, and the unterminated consumer loop can spin over the heap issuing MMIO writes. On these boards EDMA is required for MMC, SPI, audio and network DMA, so a probe-time panic or corrupted queue configuration renders the system unbootable or unusable, and `edma_pm_resume()` reproduces it on every resume."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:47.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93"
        },
        {
          "url": "https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f"
        }
      ],
      "title": "dmaengine: ti: edma: Fix memory allocation size for queue_priority_map",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39869",
    "datePublished": "2025-09-23T06:00:43.852Z",
    "dateReserved": "2025-04-16T07:20:57.143Z",
    "dateUpdated": "2026-08-05T12:05:47.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}