In the Linux kernel, the following vulnerability has been resolved:
dmaengine: ti: edma: Fix memory allocation size for queueprioritymap
Fix a critical memory allocation bug in edmasetupfromhw() where queueprioritymap was allocated with insufficient memory. The code declared queuepriority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size.
This caused out-of-bounds memory writes when accessing: queueprioritymap[i][0] = i; queueprioritymap[i][1] = i;
The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang.
Change the allocation to use sizeof(*queueprioritymap) which automatically gets the correct size for the 2D array structure.
[
{
"deprecated": false,
"id": "CVE-2025-39869-0ab4a48c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1baed10553fc8b388351d8fc803e3ae6f1a863bc",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-0dfff6c2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301a96cc4dc006c9a285913d301e681cfbf7edb6",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-28f2b3d2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@069fd1688c57c0cc8a3de64d108579b31676f74b",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-40cd626b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e63419dbf2ceb083c1651852209c7f048089ac0f",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "80807531399185927244718047229633227787",
"length": 1431.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-5735c9dd",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-5915d329",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@069fd1688c57c0cc8a3de64d108579b31676f74b",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-73d8db82",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d4de60d6db02d9b01d5890d5156b04fad65d07a",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-7a06cb37",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"71336912513193798023785502533481025640",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-7a9ad5ab",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5e82f3f2c918d446df46e8d65f8083fd97cdec5",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "80807531399185927244718047229633227787",
"length": 1431.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-85c46069",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1baed10553fc8b388351d8fc803e3ae6f1a863bc",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-9a35d191",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d722de80ce037dccf6931e778f4a46499d51bdf9",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-9f9fafc8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d4de60d6db02d9b01d5890d5156b04fad65d07a",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-b46b8607",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e63419dbf2ceb083c1651852209c7f048089ac0f",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"71336912513193798023785502533481025640",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-c16c7db8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301a96cc4dc006c9a285913d301e681cfbf7edb6",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-c83d0c34",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"150890302154742661628519138292953640338",
"271334641056386179365617129607069905124",
"88881218560841514628493610546407653277",
"60204971696198775650251955015916944710",
"184971391698835473656565128579560199308"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39869-d73ab471",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d722de80ce037dccf6931e778f4a46499d51bdf9",
"signature_version": "v1",
"target": {
"file": "drivers/dma/ti/edma.c",
"function": "edma_setup_from_hw"
},
"digest": {
"function_hash": "201358334920321451382100712577986471641",
"length": 1433.0
}
}
]