CVE-2025-71195
Description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinx: xdma: Fix regmap max_register
The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault:
tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[1217] exited with preempt_count 1 Segmentation fault
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In the Linux kernel's Xilinx XDMA driver, the regmap max_register is set to the memory region size instead of the last register offset, causing a crash when reading registers via debugfs.
Vulnerability
In the Linux kernel's Xilinx XDMA DMA engine driver (dmaengine: xilinx: xdma), the max_register field of the regmap is incorrectly assigned the size of the register memory region instead of the offset of the last register. This misconfiguration causes the regmap framework to attempt reads beyond the valid register range when accessing the regmap debugfs is used.
Exploitation
An attacker with local access to the system can trigger the vulnerability by reading from the regmap debugfs file, for example via tail /sys/kernel/debug/regmap/xdma.1.auto/registers. No special privileges beyond the ability to read debugfs files are required. The kernel then performs a read from an invalid address, leading to a translation fault and a kernel panic.
Impact
Successful exploitation results in a kernel segmentation fault, causing a denial of service (system crash). The crash trace shows an Unable to handle kernel paging request at a virtual address, followed by a panic. This can be used by an unprivileged user to crash the system.
Mitigation
The fix has been applied to the Linux kernel stable tree in commit c7d436a6c1a2 and 5e7ad329d259 [1][2]. Users should update to a kernel version containing these commits. No workaround is available other than restricting access to debugfs or disabling the XDMA driver if not needed.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.