CVE-2025-21870: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-27 · updated 2026-10-30
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio. The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier

Affected products

Linux kernel: from 6.0 before 6.12.17; from 6.13 before 6.13.5; 6.14-rc1, 6.14-rc2, 6.14-rc3 — fixed in 6.12.17, 6.13.5
Linux: 6.0 — fixed in 6.14

How to fix

Upgrade to a fixed version: Linux kernel 6.12.17, 6.13.5; Linux 6.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-21870 or the next vulnerability affects your stack