CVE-2025-39923

What it actually does

Improper validation of device tree properties num-channels and num-ees in the Qualcomm BAM DMA driver allows invalid configuration values to be accepted without error checking, leading to incorrect channel allocation or driver state.

Why it matters to the business

Affected Linux systems on Qualcomm hardware face elevated risk of kernel instability or local security issues; low EPSS and no KEV status indicate limited active exploitation, but downstream kernel dependents increase patch urgency for container and embedded environments.

How an attack unfolds

An attacker with local access or control over device tree loading supplies crafted num-channels/ees values that bypass error paths during DMA initialization; threat actors referenced in related kernel privilege escalations on container-optimized OS may chain this with other flaws for escalation.

How to fix it

Upgrade the Linux kernel in org/pub/scm/linux/kernel/git/stable/linux.git to commit 2e257a6125c63350f00dc42b9674f20fd3cf4a9f or any later fixed revision that properly handles DT errors for num-channels/ees.

How to confirm the fix worked

Confirm the presence of the fix commit in kernel source history or verify updated package versions; test DMA initialization with malformed device tree properties to ensure errors are now handled.

Typical attack path

1. Obtain local access or ability to influence device tree on target system
2. Trigger BAM DMA driver initialization with invalid DT properties
3. Exploit resulting unchecked state to cause crash or memory corruption
4. Escalate privileges or achieve denial of service

How to detect it

Inspect kernel boot logs and dmesg for bam_dma or DT parsing errors; look for unexpected DMA channel allocation failures or crashes on systems using Qualcomm BAM hardware.

What your security team should do

• Apply the referenced kernel commit or distribution update within standard maintenance windows given low EPSS
• Audit Qualcomm BAM DMA usage in embedded and container workloads
• Monitor EPSS trend and threat actor activity around related kernel CVEs for changes in priority