Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2b6b3b7420190888793c49e97276e1e73bd7eaed to < 7d4de60d6db02d9b01d5890d5156b04fad65d07aaffected2b6b3b7420190888793c49e97276e1e73bd7eaed to < d722de80ce037dccf6931e778f4a46499d51bdf9affected2b6b3b7420190888793c49e97276e1e73bd7eaed to < 301a96cc4dc006c9a285913d301e681cfbf7edb6affected2b6b3b7420190888793c49e97276e1e73bd7eaed to < 5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93affected2b6b3b7420190888793c49e97276e1e73bd7eaed to < 1baed10553fc8b388351d8fc803e3ae6f1a863bcaffected2b6b3b7420190888793c49e97276e1e73bd7eaed to < 069fd1688c57c0cc8a3de64d108579b31676f74baffected2b6b3b7420190888793c49e97276e1e73bd7eaed to < d5e82f3f2c918d446df46e8d65f8083fd97cdec5affected2b6b3b7420190888793c49e97276e1e73bd7eaed to < e63419dbf2ceb083c1651852209c7f048089ac0faffected
Linux Linux
Default version status: affected
4.4affected0 to < 4.4unaffected5.4.300 to ≤ 5.4.*unaffected5.10.245 to ≤ 5.10.*unaffected5.15.194 to ≤ 5.15.*unaffected6.1.153 to ≤ 6.1.*unaffected6.6.107 to ≤ 6.6.*unaffected6.12.48 to ≤ 6.12.*unaffected6.16.8 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7d4de60d6db02d9b01d5890d5156b04fad65d07a ↗
- https://git.kernel.org/stable/c/d722de80ce037dccf6931e778f4a46499d51bdf9 ↗
- https://git.kernel.org/stable/c/301a96cc4dc006c9a285913d301e681cfbf7edb6 ↗
- https://git.kernel.org/stable/c/5e462fa0dfdb52b3983cf41532d3d4c7d63e2f93 ↗
- https://git.kernel.org/stable/c/1baed10553fc8b388351d8fc803e3ae6f1a863bc ↗
- https://git.kernel.org/stable/c/069fd1688c57c0cc8a3de64d108579b31676f74b ↗
- https://git.kernel.org/stable/c/d5e82f3f2c918d446df46e8d65f8083fd97cdec5 ↗
- https://git.kernel.org/stable/c/e63419dbf2ceb083c1651852209c7f048089ac0f ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗