Executive brief
A memory allocation error in the Linux kernel's TI EDMA driver can cause system instability or crashes. This component is responsible for managing direct memory access on certain Texas Instruments hardware platforms, such as those used in industrial or embedded systems. An exploit could lead to a complete system failure or allow an attacker to compromise the integrity of the operating system.
Technical details
A vulnerability exists in the edma_setup_from_hw() function within drivers/dma/ti/edma.c due to an incorrect size calculation during memory allocation for queue_priority_map. The variable is declared as a pointer to an array of two s8 elements (s8 (*)[2]), but the allocation via devm_kcalloc() incorrectly used sizeof(s8) instead of the full array size. This results in a heap-based buffer overflow when the driver attempts to initialize the map, leading to out-of-bounds writes. On ARM platforms like the BeagleBoard-X15, this corruption can trigger 'undefined instruction' faults or kernel hardening features, resulting in a Denial of Service (DoS) or potential privilege escalation. The issue is resolved by using sizeof(*queue_priority_map) to ensure the correct allocation size.
Affected products
- Linux Linux Kernel 4.4 to 6.1.153, 6.6.x, 6.10.x, 6.11.x
Timeline
- 2025-08-30: disclosed: Initial patch submitted by Anders Roxell
- 2025-09-19: patched: Patch committed to stable branches
- 2025-09-23: advisory: CVE-2025-39869 published
References
- https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b
- https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc
- https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6
- https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93
- https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a
- https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5
- https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9