{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2025-39869","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-09-23T06:15:46.097","lastModified":"2026-10-19T21:10:00.160","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: edma: Fix memory allocation size for queue_priority_map\n\nFix a critical memory allocation bug in edma_setup_from_hw() where\nqueue_priority_map was allocated with insufficient memory. The code\ndeclared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),\nbut allocated memory using sizeof(s8) instead of the correct size.\n\nThis caused out-of-bounds memory writes when accessing:\n  queue_priority_map[i][0] = i;\n  queue_priority_map[i][1] = i;\n\nThe bug manifested as kernel crashes with \"Oops - undefined instruction\"\non ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the\nmemory corruption triggered kernel hardening features on Clang.\n\nChange the allocation to use sizeof(*queue_priority_map) which\nautomatically gets the correct size for the 2D array structure."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: ti: edma: Corregir el tamaño de asignación de memoria para queue_priority_map\n\nCorregir un error crítico de asignación de memoria en edma_setup_from_hw() donde queue_priority_map fue asignado con memoria insuficiente. El código declaró queue_priority_map como s8 (*)[2] (puntero a un array de 2 s8), pero asignó memoria usando sizeof(s8) en lugar del tamaño correcto.\n\nEsto causó escrituras de memoria fuera de límites al acceder a:\nqueue_priority_map[i][0] = i;\nqueue_priority_map[i][1] = i;\n\nEl error se manifestó como fallos del kernel con 'Oops - undefined instruction' en plataformas ARM (BeagleBoard-X15) durante la sonda del controlador EDMA, ya que la corrupción de memoria activó características de endurecimiento del kernel en Clang.\n\nCambiar la asignación para usar sizeof(*queue_priority_map) lo que obtiene automáticamente el tamaño correcto para la estructura del array 2D."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/dma/ti/edma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"7d4de60d6db02d9b01d5890d5156b04fad65d07a","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"d722de80ce037dccf6931e778f4a46499d51bdf9","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"301a96cc4dc006c9a285913d301e681cfbf7edb6","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"1baed10553fc8b388351d8fc803e3ae6f1a863bc","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"069fd1688c57c0cc8a3de64d108579b31676f74b","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"d5e82f3f2c918d446df46e8d65f8083fd97cdec5","versionType":"git","status":"affected"},{"version":"2b6b3b7420190888793c49e97276e1e73bd7eaed","lessThan":"e63419dbf2ceb083c1651852209c7f048089ac0f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/dma/ti/edma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.4","status":"affected"},{"version":"0","lessThan":"4.4","versionType":"semver","status":"unaffected"},{"version":"5.4.300","lessThanOrEqual":"5.4.*","versionType":"semver","status":"unaffected"},{"version":"5.10.245","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.194","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.153","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.107","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.48","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.16.8","lessThanOrEqual":"6.16.*","versionType":"semver","status":"unaffected"},{"version":"6.17","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4","versionEndExcluding":"5.4.300","matchCriteriaId":"403BB92A-1ABA-4222-BF23-C3F184ADBEC5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.245","matchCriteriaId":"B0E443AF-02FC-45A1-9CD7-3F80A65F1A15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.194","matchCriteriaId":"CF862263-DC8D-4324-A52A-DA1D7880B35A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.153","matchCriteriaId":"39B3B4F7-FA64-4E7C-B55D-53A5D004A639"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.107","matchCriteriaId":"D273EDA6-2CFE-4EBD-B024-62EB057830F3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.48","matchCriteriaId":"9652E701-5C8E-49CF-89A5-499E214A5902"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.16.8","matchCriteriaId":"8DA00A4E-AABB-4A69-AB39-67B22D0B36D2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*","matchCriteriaId":"327D22EF-390B-454C-BD31-2ED23C998A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*","matchCriteriaId":"C730CD9A-D969-4A8E-9522-162AAF7C0EE9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*","matchCriteriaId":"39982C4B-716E-4B2F-8196-FA301F47807D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*","matchCriteriaId":"340BEEA9-D70D-4290-B502-FBB1032353B1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*","matchCriteriaId":"47E4C5C0-079F-4838-971B-8C503D48FCC2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}