Riskcovery

CVE-2025-21847

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

State
Published
Severity
5.5 Medium
Published
Mar 12, 2025
Updated
Jun 1, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • e46f81541b1bf5db45a8c7a9cbc35ffc696877dc to before dfe25c554daa12ee26eb3540bbded57733ed5d9cAffected
  • 090349a9feba3ceee3997d31d68ffe54e5b57acb to before 2b3878baf90918a361a3dfd3513025100b1b40b6Affected
  • 090349a9feba3ceee3997d31d68ffe54e5b57acb to before 62ab1ae5511c59b5f0bf550136ff321331adca9fAffected
  • 090349a9feba3ceee3997d31d68ffe54e5b57acb to before 6c18f5eb2043ebf4674c08a9690218dc818a11abAffected
  • 090349a9feba3ceee3997d31d68ffe54e5b57acb to before d8d99c3b5c485f339864aeaa29f76269cc0ea975Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.80 through 6.6.*Not affected
  • 6.12.17 through 6.12.*Not affected
  • 6.13.5 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.