CVE-2025-39923

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39923", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.147Z", "datePublished": "2025-10-01T08:07:11.469Z", "dateUpdated": "2026-05-23T16:00:59.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:00:59.237Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees\n\nWhen we don't have a clock specified in the device tree, we have no way to\nensure the BAM is on. This is often the case for remotely-controlled or\nremotely-powered BAM instances. In this case, we need to read num-channels\nfrom the DT to have all the necessary information to complete probing.\n\nHowever, at the moment invalid device trees without clock and without\nnum-channels still continue probing, because the error handling is missing\nreturn statements. The driver will then later try to read the number of\nchannels from the registers. This is unsafe, because it relies on boot\nfirmware and lucky timing to succeed. Unfortunately, the lack of proper\nerror handling here has been abused for several Qualcomm SoCs upstream,\ncausing early boot crashes in several situations [1, 2].\n\nAvoid these early crashes by erroring out when any of the required DT\nproperties are missing. Note that this will break some of the existing DTs\nupstream (mainly BAM instances related to the crypto engine). However,\nclearly these DTs have never been tested properly, since the error in the\nkernel log was just ignored. It's safer to disable the crypto engine for\nthese broken DTBs.\n\n[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/\n[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/qcom/bam_dma.c"], "versions": [{"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "2e257a6125c63350f00dc42b9674f20fd3cf4a9f", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "555bd16351a35c79efb029a196975a5a27f7fbc4", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "ebf6c7c908e5999531c3517289598f187776124f", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "1fc14731f0be4885e60702b9596d14d9a79cf053", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "0ff9df758af7022d749718fb6b8385cc5693acf3", "status": "affected", "versionType": "git"}, {"version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "lessThan": "5068b5254812433e841a40886e695633148d362d", "status": "affected", "versionType": "git"}, {"version": "cecf8a69042b3a54cb843223756c10ee8a8665e3", "status": "affected", "versionType": "git"}, {"version": "909474cd384cb206f33461fbd18089cf170533f8", "status": "affected", "versionType": "git"}, {"version": "5e0986f7caf17d7b1acd2092975360bf8e88a57d", "status": "affected", "versionType": "git"}, {"version": "4.9.104", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.45", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.16.13", "lessThan": "4.17", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma/qcom/bam_dma.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.300", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.245", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.153", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.107", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.48", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.8", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.4.300"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.245"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.194"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.48"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.16.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2e257a6125c63350f00dc42b9674f20fd3cf4a9f"}, {"url": "https://git.kernel.org/stable/c/1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2"}, {"url": "https://git.kernel.org/stable/c/6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c"}, {"url": "https://git.kernel.org/stable/c/555bd16351a35c79efb029a196975a5a27f7fbc4"}, {"url": "https://git.kernel.org/stable/c/ebf6c7c908e5999531c3517289598f187776124f"}, {"url": "https://git.kernel.org/stable/c/1fc14731f0be4885e60702b9596d14d9a79cf053"}, {"url": "https://git.kernel.org/stable/c/0ff9df758af7022d749718fb6b8385cc5693acf3"}, {"url": "https://git.kernel.org/stable/c/5068b5254812433e841a40886e695633148d362d"}], "title": "dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:41.678Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/dma/qcom/bam_dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2e257a6125c63350f00dc42b9674f20fd3cf4a9f", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "555bd16351a35c79efb029a196975a5a27f7fbc4", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "ebf6c7c908e5999531c3517289598f187776124f", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "1fc14731f0be4885e60702b9596d14d9a79cf053", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "0ff9df758af7022d749718fb6b8385cc5693acf3", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"lessThan": "5068b5254812433e841a40886e695633148d362d", "status": "affected", "version": "48d163b1aa6e7f650c0b7a4f9c61c387a6def868", "versionType": "git"}, {"status": "affected", "version": "cecf8a69042b3a54cb843223756c10ee8a8665e3", "versionType": "git"}, {"status": "affected", "version": "909474cd384cb206f33461fbd18089cf170533f8", "versionType": "git"}, {"status": "affected", "version": "5e0986f7caf17d7b1acd2092975360bf8e88a57d", "versionType": "git"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.104", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.45", "versionType": "semver"}, {"lessThan": "4.17", "status": "affected", "version": "4.16.13", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/dma/qcom/bam_dma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.300", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.245", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.194", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.153", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.107", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.48", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26B405C2-E93C-4D65-9962-B0AFD97649C3", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.104", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D700D41-4E8D-4E37-8603-F71095BDF7CF", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.45", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E26A8B1-0C45-4B7E-9139-8B5C16E0D384", "versionEndExcluding": "5.4.300", "versionStartIncluding": "4.16.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0E443AF-02FC-45A1-9CD7-3F80A65F1A15", "versionEndExcluding": "5.10.245", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF862263-DC8D-4324-A52A-DA1D7880B35A", "versionEndExcluding": "5.15.194", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "39B3B4F7-FA64-4E7C-B55D-53A5D004A639", "versionEndExcluding": "6.1.153", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D273EDA6-2CFE-4EBD-B024-62EB057830F3", "versionEndExcluding": "6.6.107", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9652E701-5C8E-49CF-89A5-499E214A5902", "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DA00A4E-AABB-4A69-AB39-67B22D0B36D2", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees\n\nWhen we don't have a clock specified in the device tree, we have no way to\nensure the BAM is on. This is often the case for remotely-controlled or\nremotely-powered BAM instances. In this case, we need to read num-channels\nfrom the DT to have all the necessary information to complete probing.\n\nHowever, at the moment invalid device trees without clock and without\nnum-channels still continue probing, because the error handling is missing\nreturn statements. The driver will then later try to read the number of\nchannels from the registers. This is unsafe, because it relies on boot\nfirmware and lucky timing to succeed. Unfortunately, the lack of proper\nerror handling here has been abused for several Qualcomm SoCs upstream,\ncausing early boot crashes in several situations [1, 2].\n\nAvoid these early crashes by erroring out when any of the required DT\nproperties are missing. Note that this will break some of the existing DTs\nupstream (mainly BAM instances related to the crypto engine). However,\nclearly these DTs have never been tested properly, since the error in the\nkernel log was just ignored. It's safer to disable the crypto engine for\nthese broken DTBs.\n\n[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/\n[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: qcom: bam_dma: Correcci\u00f3n del manejo de errores de DT para num-channels/ees\n\nCuando no tenemos un reloj especificado en el \u00e1rbol de dispositivos, no tenemos forma de asegurar que el BAM est\u00e9 encendido. Este es a menudo el caso para instancias de BAM controladas remotamente o alimentadas remotamente. En este caso, necesitamos leer num-channels del DT para tener toda la informaci\u00f3n necesaria para completar el sondeo.\n\nSin embargo, en este momento los \u00e1rboles de dispositivos inv\u00e1lidos sin reloj y sin num-channels todav\u00eda contin\u00faan el sondeo, porque al manejo de errores le faltan sentencias de retorno. El controlador intentar\u00e1 entonces m\u00e1s tarde leer el n\u00famero de canales de los registros. Esto es inseguro, porque depende del firmware de arranque y de una sincronizaci\u00f3n afortunada para tener \u00e9xito. Desafortunadamente, la falta de un manejo de errores adecuado aqu\u00ed ha sido abusada para varios SoCs de Qualcomm en la rama principal, causando fallos de arranque tempranos en varias situaciones [1, 2].\n\nEvite estos fallos tempranos al generar un error cuando falte alguna de las propiedades de DT requeridas. Tenga en cuenta que esto romper\u00e1 algunos de los DTs existentes en la rama principal (principalmente instancias de BAM relacionadas con el motor criptogr\u00e1fico). Sin embargo, claramente estos DTs nunca han sido probados correctamente, ya que el error en el registro del kernel fue simplemente ignorado. Es m\u00e1s seguro deshabilitar el motor criptogr\u00e1fico para estos DTBs rotos.\n\n[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/\n[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/"}], "id": "CVE-2025-39923", "lastModified": "2026-10-19T22:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-10-01T08:15:35.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0ff9df758af7022d749718fb6b8385cc5693acf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d98ba204d8a6db0d986c7f1aefaa0dcd1c007a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1fc14731f0be4885e60702b9596d14d9a79cf053"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e257a6125c63350f00dc42b9674f20fd3cf4a9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5068b5254812433e841a40886e695633148d362d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/555bd16351a35c79efb029a196975a5a27f7fbc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ac1599d0e78036d9d08efc2f58c2d91f0a3ee4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebf6c7c908e5999531c3517289598f187776124f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees", "id": "2400631", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2400631"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees\nWhen we don't have a clock specified in the device tree, we have no way to\nensure the BAM is on. This is often the case for remotely-controlled or\nremotely-powered BAM instances. In this case, we need to read num-channels\nfrom the DT to have all the necessary information to complete probing.\nHowever, at the moment invalid device trees without clock and without\nnum-channels still continue probing, because the error handling is missing\nreturn statements. The driver will then later try to read the number of\nchannels from the registers. This is unsafe, because it relies on boot\nfirmware and lucky timing to succeed. Unfortunately, the lack of proper\nerror handling here has been abused for several Qualcomm SoCs upstream,\ncausing early boot crashes in several situations [1, 2].\nAvoid these early crashes by erroring out when any of the required DT\nproperties are missing. Note that this will break some of the existing DTs\nupstream (mainly BAM instances related to the crypto engine). However,\nclearly these DTs have never been tested properly, since the error in the\nkernel log was just ignored. It's safer to disable the crypto engine for\nthese broken DTBs.\n[1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/\n[2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/"], "name": "CVE-2025-39923", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39923\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39923\nhttps://lore.kernel.org/linux-cve-announce/2025100122-CVE-2025-39923-6775@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-02T08:40:11.147557+00:00", "updated": "2025-10-02T08:40:11.147611+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}