Critical Vulnerability in Linux Package: NULL Pointer Dereference in ASoC IPC4 Topology
Summary
DEBIAN-CVE-2025-21870: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers Other, non DAI copier widgets could have the same stream name (sname) as the ALH copie... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for various applications and services, ensuring efficient communication between software and hardware. This specific vulnerability affects the ASoC (ALSA System on Chip) subsystem, which is responsible for audio processing in embedded systems. The vulnerability arises from improper handling of ALH (Audio Low Latency) copiers, potentially leading to system crashes and audio malfunctions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC subsystem related to the ipc4-topology. The issue occurs when non-DAI (Digital Audio Interface) copier widgets share the same stream name as the ALH copier. In such cases, the copier's data becomes NULL, leading to a NULL pointer dereference. This can cause a crash in the sof_ipc4_prepare_copier_module() function and miscalculations in the ALH device count in sof_ipc4_widget_setup_comp_dai(), resulting in broken audio output. The vulnerability is critical as it affects the stability and functionality of audio processing in systems relying on this kernel.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior related to audio processing until the patch is applied.
Conclusion
The identified vulnerability in the Linux package poses a significant risk to system stability and audio functionality. Users are strongly encouraged to update to the patched version to protect their systems from potential crashes and audio issues. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a NULL pointer dereference in the ASoC subsystem of the Linux kernel, which can lead to system crashes and audio issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failure to address this vulnerability may result in system instability, crashes, and degraded audio performance in applications relying on the Linux kernel.
Yes, the vulnerability affects the Linux package in Debian versions 13 and 14, specifically before the fixed version 6.12.17-1.
Update your Linux package to version 6.12.17-1 or later to mitigate the vulnerability and ensure system stability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
