CVE-2025-39869CWE-125

CVE-2025-39869

High · published September 23, 2025

CVSS v3.1
8.4
EPSS
0%
Percentile
5.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: ti: edma: Fix memory allocation size for queue_priority_map

Fix a critical memory allocation bug in edma_setup_from_hw() where

queue_priority_map was allocated with insufficient memory. The code

declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8),

but allocated memory using sizeof(s8) instead of the correct size.

This caused out-of-bounds memory writes when accessing:

queue_priority_map[i][0] = i;

queue_priority_map[i][1] = i;

The bug manifested as kernel crashes with "Oops - undefined instruction"

on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the

memory corruption triggered kernel hardening features on Clang.

Change the allocation to use sizeof(*queue_priority_map) which

automatically gets the correct size for the 2D array structure.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00164 · 5.3th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-09-23T10:15Z
Affected products (13)
ProductVersionsFixed in
linux/linux_kernel≥ 4.4, < 5.4.3005.4.300
linux/linux_kernel≥ 5.5, < 5.10.2455.10.245
linux/linux_kernel≥ 5.11, < 5.15.1945.15.194
linux/linux_kernel≥ 5.16, < 6.1.1536.1.153
linux/linux_kernel≥ 6.2, < 6.6.1076.6.107
linux/linux_kernel≥ 6.7, < 6.12.486.12.48
linux/linux_kernel≥ 6.13, < 6.16.86.16.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (9)
EPSS history
Timeline
  • 23 SEP 06:00Z
    dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
    cvelistv5