CVE-2025-21870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21870", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.781Z", "datePublished": "2025-03-27T13:38:22.849Z", "dateUpdated": "2026-10-30T12:20:53.223Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:20:53.223Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\n\nOther, non DAI copier widgets could have the same stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\n\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the local ALSA PCM character device (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which flows into `sof_pcm_hw_params()` \u2192 `sof_prepare_widgets_in_path()` \u2192 `sof_ipc4_prepare_copier_module()`. There is no network or remote-peer input on this path.\nAC:L - On an affected system (Intel SoundWire/ALH platform whose topology has a non-DAI widget sharing an `sname` with an ALH copier), the attacker simply opens the PCM device and issues hw_params \u2014 the faulty widget-matching loop runs deterministically every time, with no race to win and no memory layout to guess.\nPR:L - Only access to the sound PCM device node is required, which any logged-in desktop user gets via logind ACLs and any `audio`-group member gets on servers/embedded systems; no capability check exists anywhere along the hw_params \u2192 widget-prepare path.\nUI:N - The attacker performs the entire sequence themselves by opening the PCM device and calling hw_params; no victim action, mount, or file-open by another user is needed.\nS:U - The type confusion and heap corruption occur in kernel memory within the same security authority as the attacking local user; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion causes `dai->private` to be read from a mismatched struct and dereferenced as `struct sof_ipc4_copier *`, disclosing arbitrary kernel heap contents, and the inflated `config_length` makes the `memcpy()` at ipc4-topology.c:2211 read past the 136-byte blob allocation into the IPC payload.\nI:H - This is a type confusion (`w->private` treated as `struct snd_sof_dai` when it is not), and the unbounded `blob->alh_cfg.mapping[i++]` loop can write past the fixed 16-entry array in a kmalloc-192 object, giving a heap out-of-bounds write that is leverageable for control-flow corruption.\nA:H - The commit explicitly documents a NULL/wild pointer dereference causing a kernel oops, and the miscounted `device_count` additionally corrupts the ALH blob and yields `GENMASK(-1, 0)` via a zero `step` \u2014 any of which panics the kernel and can be re-triggered at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "versions": [{"version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "ec8f5a4fe296c311d4b45db7a25a0e9e69802372", "status": "affected", "versionType": "git"}, {"version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "6b6b47c1aa717a0ed3400e00a81dfea686a41d7f", "status": "affected", "versionType": "git"}, {"version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "87c8768a96092ce75cd47fe076db5080db7ac515", "status": "affected", "versionType": "git"}, {"version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "93c6c2e5801aab09ef1ef99f248f3cd323c3f152", "status": "affected", "versionType": "git"}, {"version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "6fd60136d256b3b948333ebdb3835f41a95ab7ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.17", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.5", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.13.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ec8f5a4fe296c311d4b45db7a25a0e9e69802372"}, {"url": "https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f"}, {"url": "https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515"}, {"url": "https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152"}, {"url": "https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}], "title": "ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:43:21.426828Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:54.263Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:43:21.426828Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:43:21.897Z"}}], "cna": {"title": "ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the local ALSA PCM character device (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which flows into `sof_pcm_hw_params()` \u2192 `sof_prepare_widgets_in_path()` \u2192 `sof_ipc4_prepare_copier_module()`. There is no network or remote-peer input on this path.\nAC:L - On an affected system (Intel SoundWire/ALH platform whose topology has a non-DAI widget sharing an `sname` with an ALH copier), the attacker simply opens the PCM device and issues hw_params \u2014 the faulty widget-matching loop runs deterministically every time, with no race to win and no memory layout to guess.\nPR:L - Only access to the sound PCM device node is required, which any logged-in desktop user gets via logind ACLs and any `audio`-group member gets on servers/embedded systems; no capability check exists anywhere along the hw_params \u2192 widget-prepare path.\nUI:N - The attacker performs the entire sequence themselves by opening the PCM device and calling hw_params; no victim action, mount, or file-open by another user is needed.\nS:U - The type confusion and heap corruption occur in kernel memory within the same security authority as the attacking local user; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion causes `dai->private` to be read from a mismatched struct and dereferenced as `struct sof_ipc4_copier *`, disclosing arbitrary kernel heap contents, and the inflated `config_length` makes the `memcpy()` at ipc4-topology.c:2211 read past the 136-byte blob allocation into the IPC payload.\nI:H - This is a type confusion (`w->private` treated as `struct snd_sof_dai` when it is not), and the unbounded `blob->alh_cfg.mapping[i++]` loop can write past the fixed 16-entry array in a kmalloc-192 object, giving a heap out-of-bounds write that is leverageable for control-flow corruption.\nA:H - The commit explicitly documents a NULL/wild pointer dereference causing a kernel oops, and the miscounted `device_count` additionally corrupts the ALH blob and yields `GENMASK(-1, 0)` via a zero `step` \u2014 any of which panics the kernel and can be re-triggered at will."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "ec8f5a4fe296c311d4b45db7a25a0e9e69802372", "versionType": "git"}, {"status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "6b6b47c1aa717a0ed3400e00a81dfea686a41d7f", "versionType": "git"}, {"status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "87c8768a96092ce75cd47fe076db5080db7ac515", "versionType": "git"}, {"status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "93c6c2e5801aab09ef1ef99f248f3cd323c3f152", "versionType": "git"}, {"status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "lessThan": "6fd60136d256b3b948333ebdb3835f41a95ab7ef", "versionType": "git"}], "programFiles": ["sound/soc/sof/ipc4-topology.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.17", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.5", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/soc/sof/ipc4-topology.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ec8f5a4fe296c311d4b45db7a25a0e9e69802372"}, {"url": "https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f"}, {"url": "https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515"}, {"url": "https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152"}, {"url": "https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\n\nOther, non DAI copier widgets could have the same stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\n\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.17", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.5", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:20:53.223Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21870", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:20:53.223Z", "dateReserved": "2024-12-29T08:45:45.781Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-27T13:38:22.849Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ec8f5a4fe296c311d4b45db7a25a0e9e69802372", "status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "versionType": "git"}, {"lessThan": "6b6b47c1aa717a0ed3400e00a81dfea686a41d7f", "status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "versionType": "git"}, {"lessThan": "87c8768a96092ce75cd47fe076db5080db7ac515", "status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "versionType": "git"}, {"lessThan": "93c6c2e5801aab09ef1ef99f248f3cd323c3f152", "status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "versionType": "git"}, {"lessThan": "6fd60136d256b3b948333ebdb3835f41a95ab7ef", "status": "affected", "version": "a150345aa758492e05d2934f318ce7c2566b1cfe", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/soc/sof/ipc4-topology.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.17", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E20AECFF-A1D7-4E25-8461-0B0088CAF2DA", "versionEndExcluding": "6.12.17", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "72E69ABB-9015-43A6-87E1-5150383CFFD9", "versionEndExcluding": "6.13.5", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*", "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\n\nOther, non DAI copier widgets could have the same stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\n\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: ipc4-topology: Bucles reforzados para la b\u00fasqueda de copiadores ALH. Otros widgets de copiadores no DAI podr\u00edan tener el mismo nombre de flujo (sname) que el copiador ALH y, en ese caso, copier->data es NULL, sin alh_data adjunto, lo que podr\u00eda provocar una desreferencia de puntero NULL. Podr\u00edamos comprobar este puntero NULL en sof_ipc4_prepare_copier_module() y evitar el fallo, pero un bucle similar en sof_ipc4_widget_setup_comp_dai() calcular\u00eda err\u00f3neamente el n\u00famero de dispositivos ALH, lo que provocar\u00eda un audio interrumpido. La soluci\u00f3n correcta es reforzar la l\u00f3gica de coincidencia asegur\u00e1ndose de que: 1. el widget sea un widget DAI, por lo que dai = w->private es v\u00e1lido; 2. el dai (y, por lo tanto, el copiador) sea un copiador ALH."}], "id": "CVE-2025-21870", "lastModified": "2026-10-30T13:17:53.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21870", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:43:21.426828Z", "version": "2.0.3"}}]}, "published": "2025-03-27T14:15:48.543", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec8f5a4fe296c311d4b45db7a25a0e9e69802372"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers", "id": "2355328", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355328"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\nOther, non DAI copier widgets could have the same stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier"], "name": "CVE-2025-21870", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21870\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21870\nhttps://lore.kernel.org/linux-cve-announce/2025032735-CVE-2025-21870-4c78@gregkh/T"], "threat_severity": "Low"}

{}