CVE-2025-21870

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21870

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copier and in that case the copier->data is NULL, no alh_data is attached, which could lead to NULL pointer dereference. We could check for this NULL pointer in sof_ipc4_prepare_copier_module() and avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai() will miscalculate the ALH device count, causing broken audio. The correct fix is to harden the matching logic by making sure that the 1. widget is a DAI widget - so dai = w->private is valid 2. the dai (and thus the copier) is ALH copier

References
Link Resource
https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef Patch
https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515 Patch
https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
History

29 Oct 2025, 21:07

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: ipc4-topology: Bucles reforzados para la búsqueda de copiadores ALH. Otros widgets de copiadores no DAI podrían tener el mismo nombre de flujo (sname) que el copiador ALH y, en ese caso, copier->data es NULL, sin alh_data adjunto, lo que podría provocar una desreferencia de puntero NULL. Podríamos comprobar este puntero NULL en sof_ipc4_prepare_copier_module() y evitar el fallo, pero un bucle similar en sof_ipc4_widget_setup_comp_dai() calcularía erróneamente el número de dispositivos ALH, lo que provocaría un audio interrumpido. La solución correcta es reforzar la lógica de coincidencia asegurándose de que: 1. el widget sea un widget DAI, por lo que dai = w->private es válido; 2. el dai (y, por lo tanto, el copiador) sea un copiador ALH.
References () https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef - () https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef - Patch
References () https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515 - () https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515 - Patch
References () https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152 - () https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152 - Patch

27 Mar 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 14:15

Updated : 2025-10-29 21:07

NVD link : CVE-2025-21870

Mitre link : CVE-2025-21870

CVE.ORG link : CVE-2025-21870

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference