CVE-2025-39869: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39869 is a memory allocation bug in the Linux kernel's TI EDMA (Enhanced Direct Memory Access) driver that causes out-of-bounds memory writes, leading to kernel crashes and potential information disclosure. The vulnerability exists in the edma_setup_from_hw() function, where queue_priority_map is allocated with insufficient memory (sizeof(s8) instead of sizeof(*queue_priority_map)). It was published on September 23, 2025, and affects Linux kernel versions from 4.4 through multiple stable branches up to 6.17-rc5, as well as Debian Linux 11.0. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read), though the bug also involves out-of-bounds writes due to an undersized heap allocation. In edma_setup_from_hw(), queue_priority_map is declared as s8 (*)[2] (a pointer to an array of two s8 values), but memory is allocated using sizeof(s8) — allocating only 1 byte per entry instead of the required 2 bytes. When the driver subsequently writes to queue_priority_map[i][0] and queue_priority_map[i][1], it overflows the allocated buffer, corrupting adjacent kernel memory. On ARM platforms such as BeagleBoard-X15, this manifests as kernel panics with "Oops - undefined instruction" errors during EDMA driver probe, particularly when the kernel is compiled with Clang's hardening features enabled. The fix changes the allocation to use sizeof(*queue_priority_map) to correctly size the 2D array structure (Feedly, kernel.org patch).

Successful triggering of this vulnerability results in kernel memory corruption that can cause system crashes (denial of service) and potential exposure of sensitive kernel memory contents (confidentiality impact). On ARM-based systems, the corruption reliably triggers kernel hardening mechanisms, preventing EDMA driver initialization and rendering DMA-dependent subsystems unavailable. The CVSS assessment reflects high confidentiality and availability impact with no integrity impact, scoped to the local system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability requires local access with low privileges (PR:L) to trigger, limiting its attack surface primarily to users or processes with the ability to load or interact with the EDMA driver. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing "Oops - undefined instruction" errors during EDMA driver probe on ARM platforms; kernel BUG or panic traces referencing edma_setup_from_hw() or the ti-edma driver module.
• System Behavior: Unexpected system reboots or kernel panics during boot on ARM-based systems (e.g., BeagleBoard-X15) with TI EDMA hardware; failure of DMA-dependent peripherals to initialize.
• Process: EDMA driver probe failures visible in dmesg output, particularly on systems compiled with Clang and kernel hardening features enabled.

Update the Linux kernel to one of the patched stable versions: 5.4.300, 5.10.245, 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8, or 6.17-rc6 and later. Patches are available from kernel.org stable branches and through vendor advisories from Red Hat, Debian (DLA-4404-1), Ubuntu (USN-8033 series, USN-8095 series, USN-8125-1, USN-8163 series, USN-8243-1), and Mageia. As a temporary workaround for systems that cannot be immediately patched, disabling the EDMA driver (if not required for operations) can prevent the vulnerable code path from executing (Feedly, Debian LTS).