ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
Affects Linux kernel 6.0 to 6.6.159, 6.7 to 6.12.16, and 6.13.0 to 6.13.4 on SOF audio where non-DAI copiers share an ALH copier's stream name. Fixed in 6.6.160, 6.12.17, 6.13.5.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 6.6.160, 6.12.17, 6.13.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio. The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
6.0
- KernelLinux
From 6.0.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.17; From 6.13.0 · fixed in 6.13.5
References 5
Questions about CVE-2025-21870
What does this mean?
Loops that look up ALH copier widgets could hit a NULL pointer dereference, which could crash the system. A miscalculated ALH device count can also cause broken audio.Source: git.kernel.org
Am I affected, and how do I check?
Kernel versions from 6.0 up to 6.6.160, from 6.7 up to 6.12.17, and from 6.13.0 up to 6.13.5 are listed as affected. Check the running version with uname -r. The bug needs other non-DAI copier widgets to use the same stream name (sname) as the ALH copier.Source: git.kernel.org
What should I do about it?
Upgrade to kernel 6.6.160, 6.12.17, 6.13.5, or a later release in the same branch.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data