{"id":"CVE-2025-21870","state":"PUBLISHED","title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\n\nOther, non DAI copier widgets could have the same  stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\n\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier","publishedAt":"2025-03-27T13:38:22.849Z","updatedAt":"2026-10-30T12:20:53.223Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"ec8f5a4fe296c311d4b45db7a25a0e9e69802372","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"6b6b47c1aa717a0ed3400e00a81dfea686a41d7f","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"87c8768a96092ce75cd47fe076db5080db7ac515","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"93c6c2e5801aab09ef1ef99f248f3cd323c3f152","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sof/ipc4-topology.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.17","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.5","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sof/ipc4-topology.c"]}],"references":["https://git.kernel.org/stable/c/ec8f5a4fe296c311d4b45db7a25a0e9e69802372","https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f","https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515","https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152","https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"],"weaknesses":[],"ingestedAt":"2026-10-30T12:38:04.623Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21870.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21870","state":"PUBLISHED","datePublished":"2025-03-27T13:38:22.849Z","dateUpdated":"2026-10-30T12:20:53.223Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.781Z"},"containers":{"cna":{"title":"ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers\n\nOther, non DAI copier widgets could have the same  stream name (sname) as\nthe ALH copier and in that case the copier->data is NULL, no alh_data is\nattached, which could lead to NULL pointer dereference.\nWe could check for this NULL pointer in sof_ipc4_prepare_copier_module()\nand avoid the crash, but a similar loop in sof_ipc4_widget_setup_comp_dai()\nwill miscalculate the ALH device count, causing broken audio.\n\nThe correct fix is to harden the matching logic by making sure that the\n1. widget is a DAI widget - so dai = w->private is valid\n2. the dai (and thus the copier) is ALH copier"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"ec8f5a4fe296c311d4b45db7a25a0e9e69802372","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"6b6b47c1aa717a0ed3400e00a81dfea686a41d7f","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"87c8768a96092ce75cd47fe076db5080db7ac515","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"93c6c2e5801aab09ef1ef99f248f3cd323c3f152","versionType":"git"},{"version":"a150345aa758492e05d2934f318ce7c2566b1cfe","status":"affected","lessThan":"6fd60136d256b3b948333ebdb3835f41a95ab7ef","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sof/ipc4-topology.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.17","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.5","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/sof/ipc4-topology.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ec8f5a4fe296c311d4b45db7a25a0e9e69802372"},{"url":"https://git.kernel.org/stable/c/6b6b47c1aa717a0ed3400e00a81dfea686a41d7f"},{"url":"https://git.kernel.org/stable/c/87c8768a96092ce75cd47fe076db5080db7ac515"},{"url":"https://git.kernel.org/stable/c/93c6c2e5801aab09ef1ef99f248f3cd323c3f152"},{"url":"https://git.kernel.org/stable/c/6fd60136d256b3b948333ebdb3835f41a95ab7ef"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the local ALSA PCM character device (`/dev/snd/pcmC*D*`) via `SNDRV_PCM_IOCTL_HW_PARAMS`, which flows into `sof_pcm_hw_params()` → `sof_prepare_widgets_in_path()` → `sof_ipc4_prepare_copier_module()`. There is no network or remote-peer input on this path.\nAC:L - On an affected system (Intel SoundWire/ALH platform whose topology has a non-DAI widget sharing an `sname` with an ALH copier), the attacker simply opens the PCM device and issues hw_params — the faulty widget-matching loop runs deterministically every time, with no race to win and no memory layout to guess.\nPR:L - Only access to the sound PCM device node is required, which any logged-in desktop user gets via logind ACLs and any `audio`-group member gets on servers/embedded systems; no capability check exists anywhere along the hw_params → widget-prepare path.\nUI:N - The attacker performs the entire sequence themselves by opening the PCM device and calling hw_params; no victim action, mount, or file-open by another user is needed.\nS:U - The type confusion and heap corruption occur in kernel memory within the same security authority as the attacking local user; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion causes `dai->private` to be read from a mismatched struct and dereferenced as `struct sof_ipc4_copier *`, disclosing arbitrary kernel heap contents, and the inflated `config_length` makes the `memcpy()` at ipc4-topology.c:2211 read past the 136-byte blob allocation into the IPC payload.\nI:H - This is a type confusion (`w->private` treated as `struct snd_sof_dai` when it is not), and the unbounded `blob->alh_cfg.mapping[i++]` loop can write past the fixed 16-entry array in a kmalloc-192 object, giving a heap out-of-bounds write that is leverageable for control-flow corruption.\nA:H - The commit explicitly documents a NULL/wild pointer dereference causing a kernel oops, and the miscounted `device_count` additionally corrupts the ALH blob and yields `GENMASK(-1, 0)` via a zero `step` — any of which panics the kernel and can be re-triggered at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:20:53.223Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.13.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-21870","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:43:21.426828Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:51:54.263Z"}}]}}}