CVE-2025-39869

What it actually does

Incorrect sizeof in edma_setup_from_hw() allocates queue_priority_map with sizeof(s8) instead of sizeof(*queue_priority_map), enabling out-of-bounds writes when indexing [i][0] and [i][1] and triggering kernel oops on ARM.

Why it matters to the business

Kernel crashes during EDMA driver initialization on affected Linux systems reduce availability and may require reboots or hardware-specific workarounds until patched.

How an attack unfolds

An attacker with local access loads or probes the EDMA driver on a vulnerable kernel, triggering the undersized allocation and subsequent out-of-bounds writes that corrupt memory and crash the system; listed threat actors have not been observed exploiting this specific flaw.

How to fix it

Update the Linux kernel to commit 7d4de60d6db02d9b01d5890d5156b04fad65d07a or later; Debian users should install the fixed rails packages 2:4.1.4-1 on releases 11-14.

How to confirm the fix worked

Confirm the allocation uses sizeof(*queue_priority_map) in edma_setup_from_hw(), verify the driver probe completes without oops on BeagleBoard-X15 or equivalent ARM hardware, and check kernel version against the fixed commit.

Typical attack path

1. Obtain local access or ability to trigger driver probe
2. Cause EDMA driver initialization via hardware or module load
3. Trigger out-of-bounds writes to queue_priority_map
4. Observe kernel oops and system instability

How to detect it

Search kernel logs for "Oops - undefined instruction" during EDMA probe on ARM; review dmesg and syslog for queue_priority_map related faults around driver initialization.

What your security team should do

• Apply the kernel fix or updated Debian packages immediately on all affected systems
• Monitor for EDMA-related oops messages in dmesg during boot or module load
• Prioritize patching on ARM-based embedded or BeagleBoard platforms