Riskcovery

CVE-2025-21870

ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

State
Published
Severity
7.8 High
Published
Mar 27, 2025
Updated
Oct 30, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio.

The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • a150345aa758492e05d2934f318ce7c2566b1cfe to before ec8f5a4fe296c311d4b45db7a25a0e9e69802372Affected
  • a150345aa758492e05d2934f318ce7c2566b1cfe to before 6b6b47c1aa717a0ed3400e00a81dfea686a41d7fAffected
  • a150345aa758492e05d2934f318ce7c2566b1cfe to before 87c8768a96092ce75cd47fe076db5080db7ac515Affected
  • a150345aa758492e05d2934f318ce7c2566b1cfe to before 93c6c2e5801aab09ef1ef99f248f3cd323c3f152Affected
  • a150345aa758492e05d2934f318ce7c2566b1cfe to before 6fd60136d256b3b948333ebdb3835f41a95ab7efAffected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.17 through 6.12.*Not affected
  • 6.13.5 through 6.13.*Not affected
  • 6.14 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.