Security readout for executives and security teams
Plain-English summary
A size-calculation error in the Linux TI EDMA driver can corrupt kernel memory while the driver starts. The documented result is a kernel crash on an ARM BeagleBoard-X15. Systems not using the affected EDMA driver and hardware are less likely to be exposed.
Executive priority
Treat this as high priority for embedded or ARM systems using TI EDMA because kernel memory corruption can cause outages. For other Linux fleets, rapidly establish hardware and driver exposure before scheduling remediation. Current evidence supports urgent patching of exposed systems, not an enterprise-wide emergency response.
Technical view
edma_setup_from_hw() allocated each queue_priority_map element using sizeof(s8), although each element contains two s8 values. Initializing both values therefore wrote beyond the allocation. The upstream correction uses sizeof(*queue_priority_map), matching the declared two-element array and preventing the out-of-bounds writes.
Likely exposure
Exposure is concentrated in Linux systems containing the vulnerable TI EDMA driver code where compatible hardware causes the driver to probe. Embedded and ARM deployments deserve particular review. The supplied version data is not sufficiently clear for reliable version-only decisions; confirm distribution backports and the relevant fix commit.
Exploitation context
The CVSS 3.1 score is 8.4 with a local attack vector. The bundle reports memory corruption and kernel crashes during driver probing, but provides no evidence of active exploitation, public weaponization, or demonstrated code execution. This CVE is not identified as CISA KEV in the supplied data.
Researcher notes
The demonstrated behavior is an allocation underrun followed by deterministic out-of-bounds initialization writes during probe. The source bundle documents a crash under Clang hardening, but does not establish confidentiality loss, integrity compromise, privilege escalation, or controlled execution. Distribution-specific affected and fixed versions require separate vendor confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the queue_priority_map allocation fix or an equivalent distribution backport.
- Prioritize updates on systems using TI EDMA-compatible hardware or loading the affected driver.
- If updating is delayed, consult the operating-system vendor for supported temporary mitigations.
- Reboot into the corrected kernel and remove vulnerable kernel packages according to vendor guidance.
Validation and detection
- Record the running kernel version and compare its changelog with vendor CVE guidance and referenced fixes.
- Confirm whether TI EDMA-compatible hardware exists and whether the associated driver probes during startup.
- Review kernel logs for EDMA probe failures, memory-corruption reports, or “Oops - undefined instruction” crashes.
- Verify the installed kernel includes the sizeof(*queue_priority_map) correction or an equivalent backport.
- After updating, reboot and confirm the EDMA driver initializes without kernel faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39869 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.4HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07aCVE reference, Linux
- https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9CVE reference, Linux
- https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6CVE reference, Linux
- https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93CVE reference, Linux
- https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bcCVE reference, Linux
- https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74bCVE reference, Linux
- https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5CVE reference, Linux
- https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.