CVE-2025-39869 Overview
CVE-2025-39869 is an out-of-bounds write vulnerability in the Linux kernel's Texas Instruments EDMA (Enhanced Direct Memory Access) driver. The flaw resides in the edma_setup_from_hw() function within the dmaengine/ti/edma subsystem. The code declared queue_priority_map as s8 (*)[2], a pointer to a two-element array, but allocated memory using sizeof(s8) instead of sizeof(*queue_priority_map). Writes to queue_priority_map[i][0] and queue_priority_map[i][1] corrupted memory beyond the allocation. The bug caused kernel crashes with Oops - undefined instruction on ARM platforms such as the BeagleBoard-X15 during EDMA driver probe, because Clang kernel hardening features detected the corruption.
Critical Impact
A local, low-privileged actor able to trigger EDMA driver initialization on affected ARM systems can induce kernel memory corruption, leading to system crashes and potential exploitation of adjacent kernel structures.
Affected Products
- Linux kernel (multiple stable branches, including 6.17-rc1 through 6.17-rc5)
- Debian Linux 11.0
- ARM platforms using the TI EDMA driver (for example, BeagleBoard-X15)
Discovery Timeline
- 2025-09-23 - CVE-2025-39869 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-39869
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-125] in the TI EDMA dmaengine driver. edma_setup_from_hw() allocates memory for a two-dimensional array intended to hold queue priority pairs. The allocation uses sizeof(s8), which reserves a single signed byte per iteration, but each element of queue_priority_map is a two-byte array of s8 values. Subsequent writes overflow the undersized buffer.
On ARM builds compiled with Clang and kernel hardening features enabled, the corruption is caught during driver probe, producing an Oops - undefined instruction and halting the boot process. On systems without those hardening checks, the write silently corrupts adjacent kernel heap objects, creating conditions that a local actor could leverage for further exploitation of the running kernel.
Root Cause
The root cause is an incorrect sizeof operand passed to the kernel allocator. The declared type is s8 (*)[2], but the allocation size reflects only sizeof(s8). The fix replaces the operand with sizeof(*queue_priority_map), so the compiler computes the correct per-element size for the 2D array structure.
Attack Vector
Exploitation requires local access with the ability to load or trigger initialization of the TI EDMA driver on an affected ARM platform. User interaction is not required, and successful exploitation impacts confidentiality and availability. The most direct outcome is a denial-of-service condition through a kernel crash during driver probe. Memory corruption in adjacent kernel allocations may be reachable on non-hardened builds.
No public proof-of-concept exploit has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability manifests during normal driver initialization on affected hardware; see the referenced kernel commits for technical details.
Detection Methods for CVE-2025-39869
Indicators of Compromise
- Kernel log entries containing Oops - undefined instruction originating from edma_setup_from_hw or the edma module during boot or driver probe.
- Unexpected boot failures or kernel panics on ARM SoC platforms that rely on the TI EDMA driver.
- Crash traces referencing queue_priority_map in the call stack.
Detection Strategies
- Inventory ARM-based Linux hosts and embedded devices running kernel versions predating the fix commits listed in the kernel.org stable tree.
- Correlate dmesg and journalctl -k output for EDMA probe failures across managed Linux fleets.
- Match installed package versions against the Debian LTS Announcement for Debian 11 systems.
Monitoring Recommendations
- Forward kernel logs from Linux endpoints to a centralized logging or SIEM tier and alert on Oops, BUG:, or KASAN reports referencing dmaengine or edma.
- Monitor for unexpected reboots or driver load failures on ARM platforms used in industrial, automotive, or IoT deployments.
- Track kernel build metadata (version, config flags such as CONFIG_TI_EDMA) to identify which hosts require prioritized patching.
How to Mitigate CVE-2025-39869
Immediate Actions Required
- Apply the upstream Linux kernel patches that change the allocation to sizeof(*queue_priority_map) and reboot affected systems.
- Update Debian 11 hosts to the fixed kernel package published in the Debian LTS Announcement.
- Restrict local access to ARM systems that cannot yet be patched, especially those exposing shell access to untrusted users.
Patch Information
Fixes are available across multiple stable branches through the kernel.org stable tree. Relevant commits include 069fd16, 1baed10, 301a96c, 5e462fa, 7d4de60, d5e82f3, d722de8, and e63419d. Debian consumers should install the fixed kernel from the referenced LTS advisory.
Workarounds
- If patching cannot be performed immediately, disable or blacklist the TI EDMA driver on systems that do not require DMA offload, using a modprobe blacklist entry such as blacklist edma.
- Limit physical and remote local access to affected ARM platforms until the fixed kernel is deployed.
- Enable available kernel hardening features (for example, KASAN in test environments) to surface memory corruption during driver initialization before production rollout.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
