CVE-2025-39923
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In this case, we need to read num-channels from the DT to have all the necessary information to complete probing. However, at the moment invalid device trees without clock and without num-channels still continue probing, because the error handling is missing return statements. The driver will then later try to read the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes by erroring out when any of the required DT properties are missing. Note that this will break some of the existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the crypto engine for these broken DTBs. [1]: https://lore.kernel.org/r/[email protected]/ [2]: https://lore.kernel.org/r/[email protected]/
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-10-01 08:15:35.610000
Last modified
2026-10-19 22:10:00.130000
View original CVE JSON
{
"id": "CVE-2025-39923",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-10-01T08:15:35.610",
"lastModified": "2026-10-19T22:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees\n\nWhen we don't have a clock specified in the device tree, we have no way to\nensure the BAM is on. This is often the case for remotely-controlled or\nremotely-powered BAM instances. In this case, we need to read num-channels\nfrom the DT to have all the necessary information to complete probing.\n\nHowever, at the moment invalid device trees without clock and without\nnum-channels still continue probing, because the error handling is missing\nreturn statements. The driver will then later try to read the number of\nchannels from the registers. This is unsafe, because it relies on boot\nfirmware and lucky timing to succeed. Unfortunately, the lack of proper\nerror handling here has been abused for several Qualcomm SoCs upstream,\ncausing early boot crashes in several situations [1, 2].\n\nAvoid these early crashes by erroring out when any of the required DT\nproperties are missing. Note that this will break some of the existing DTs\nupstream (mainly BAM instances related to the crypto engine). However,\nclearly these DTs have never been tested properly, since the error in the\nkernel log was just ignored. It's safer to disable the crypto engine for\nthese broken DTBs.\n\n[1]: https://lore.kernel.org/r/[email protected]/\n[2]: https://lore.kernel.org/r/[email protected]/"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: qcom: bam_dma: Corrección del manejo de errores de DT para num-channels/ees\n\nCuando no tenemos un reloj especificado en el árbol de dispositivos, no tenemos forma de asegurar que el BAM esté encendido. Este es a menudo el caso para instancias de BAM controladas remotamente o alimentadas remotamente. En este caso, necesitamos leer num-channels del DT para tener toda la información necesaria para completar el sondeo.\n\nSin embargo, en este momento los árboles de dispositivos inválidos sin reloj y sin num-channels todavía continúan el sondeo, porque al manejo de errores le faltan sentencias de retorno. El controlador intentará entonces más tarde leer el número de canales de los registros. Esto es inseguro, porque depende del firmware de arranque y de una sincronización afortunada para tener éxito. Desafortunadamente, la falta de un manejo de errores adecuado aquí ha sido abusada para varios SoCs de Qualcomm en la rama principal, causando fallos de arranque tempranos en varias situaciones [1, 2].\n\nEvite estos fallos tempranos al generar un error cuando falte alguna de las propiedades de DT requeridas. Tenga en cuenta que esto romperá algunos de los DTs existentes en la rama principal (principalmente instancias de BAM relacionadas con el motor criptográfico). Sin embargo, claramente estos DTs nunca han sido probados correctamente, ya que el error en el registro del kernel fue simplemente ignorado. Es más seguro deshabilitar el motor criptográfico para estos DTBs rotos.\n\n[1]: https://lore.kernel.org/r/[email protected]/\n[2]: https://lore.kernel.org/r/[email protected]/"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/dma/qcom/bam_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "2e257a6125c63350f00dc42b9674f20fd3cf4a9f",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "555bd16351a35c79efb029a196975a5a27f7fbc4",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "ebf6c7c908e5999531c3517289598f187776124f",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "1fc14731f0be4885e60702b9596d14d9a79cf053",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "0ff9df758af7022d749718fb6b8385cc5693acf3",
"versionType": "git",
"status": "affected"
},
{
"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868",
"lessThan": "5068b5254812433e841a40886e695633148d362d",
"versionType": "git",
"status": "affected"
},
{
"version": "cecf8a69042b3a54cb843223756c10ee8a8665e3",
"versionType": "git",
"status": "affected"
},
{
"version": "909474cd384cb206f33461fbd18089cf170533f8",
"versionType": "git",
"status": "affected"
},
{
"version": "5e0986f7caf17d7b1acd2092975360bf8e88a57d",
"versionType": "git",
"status": "affected"
},
{
"version": "4.9.104",
"lessThan": "4.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.14.45",
"lessThan": "4.15",
"versionType": "semver",
"status": "affected"
},
{
"version": "4.16.13",
"lessThan": "4.17",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/dma/qcom/bam_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.17",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.17",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.300",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.245",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.194",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.153",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.107",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.48",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.8",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.104",
"versionEndExcluding": "4.10",
"matchCriteriaId": "26B405C2-E93C-4D65-9962-B0AFD97649C3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.45",
"versionEndExcluding": "4.15",
"matchCriteriaId": "6D700D41-4E8D-4E37-8603-F71095BDF7CF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.13",
"versionEndExcluding": "5.4.300",
"matchCriteriaId": "6E26A8B1-0C45-4B7E-9139-8B5C16E0D384"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.10.245",
"matchCriteriaId": "B0E443AF-02FC-45A1-9CD7-3F80A65F1A15"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11",
"versionEndExcluding": "5.15.194",
"matchCriteriaId": "CF862263-DC8D-4324-A52A-DA1D7880B35A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16",
"versionEndExcluding": "6.1.153",
"matchCriteriaId": "39B3B4F7-FA64-4E7C-B55D-53A5D004A639"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.107",
"matchCriteriaId": "D273EDA6-2CFE-4EBD-B024-62EB057830F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.48",
"matchCriteriaId": "9652E701-5C8E-49CF-89A5-499E214A5902"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.16.8",
"matchCriteriaId": "8DA00A4E-AABB-4A69-AB39-67B22D0B36D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
"matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
"matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
"matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/0ff9df758af7022d749718fb6b8385cc5693acf3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/1fc14731f0be4885e60702b9596d14d9a79cf053",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2e257a6125c63350f00dc42b9674f20fd3cf4a9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/5068b5254812433e841a40886e695633148d362d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/555bd16351a35c79efb029a196975a5a27f7fbc4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ebf6c7c908e5999531c3517289598f187776124f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
]
}
]
}