Critical NULL Pointer Dereference in Linux Kernel - Debian Packages
Summary
CVE-2025-21870: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copie... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting its functionality and security. This specific vulnerability affects the Advanced Sound Architecture (ASoC) subsystem, particularly in the handling of ALH copiers, which are crucial for audio data processing.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC subsystem related to the ipc4-topology. The issue arises when non-DAI copier widgets share the same stream name as the ALH copier, leading to a NULL pointer dereference when the copier's data is NULL. This can result in application crashes or broken audio functionality. The vulnerability is rooted in inadequate checks within the matching logic of the system, specifically in the sof_ipc4_prepare_copier_module() and sof_ipc4_widget_setup_comp_dai() functions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-21870 vulnerability in the Linux kernel poses a significant risk due to the potential for NULL pointer dereference, leading to application crashes and audio issues. It is crucial for users to update their systems to the patched version to mitigate these risks.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21870 is a vulnerability in the Linux kernel's ASoC subsystem that can lead to a NULL pointer dereference, potentially causing application crashes or broken audio.
If your system uses the affected Linux kernel version, it may experience crashes or audio issues due to the NULL pointer dereference.
Yes, a patch is available for Debian 13 in version 6.12.17-1. Users of Debian 12 should monitor for updates.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and apply the patch as soon as it is available.
You can use Vulert, which allows you to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can also check your application using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
