CVE-2025-71195: dmaengine: xilinx: xdma: Fix regmap max_register
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinx: xdma: Fix regmap maxregister
The maxregister field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault:
tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmapmmioread32le+0x10/0x30 regmapbusregread+0x74/0xc0 regmapread+0x68/0x198 regmapread+0x54/0x88 regmapreaddebugfs+0x140/0x380 regmapmapreadfile+0x30/0x48 fullproxyread+0x68/0xc8 vfsread+0xcc/0x310 ksysread+0x7c/0x120 arm64sysread+0x24/0x40 invokesyscall.constprop.0+0x64/0x108 doel0svc+0xb0/0xd8 el0svc+0x38/0x130 el0t64synchandler+0x120/0x138 el0t64sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[1217] exited with preemptcount 1 Segmentation fault
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel with the Xilinx XDMA dmaengine driver are exposed when the affected regmap debugfs interface is available and accessed. The reported failure occurs on arm64.
What action triggers the failure?
Reading the XDMA regmap registers through debugfs can trigger a kernel paging fault because the regmap maximum register boundary is calculated incorrectly. The example command is reading /sys/kernel/debug/regmap/xdma.1.auto/registers with tail.
What is the impact of a successful trigger?
The kernel can hit a paging request fault and produce a call trace in the regmap debugfs read path. The provided report shows the reading process exiting with interrupts disabled and a nonzero preemption count.