5.5

CVE-2025-21847

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()

The nullity of sps->cstream should be checked similarly as it is done in
sof_set_stream_data_offset() function.
Assuming that it is not NULL if sps->stream is NULL is incorrect and can
lead to NULL pointer dereference.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.3 < 6.6.80
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.17
Linux ≫ Linux Kernel Version >= 6.13 < 6.13.5
Linux ≫ Linux Kernel Version6.14 Updaterc1
Linux ≫ Linux Kernel Version6.14 Updaterc2
Linux ≫ Linux Kernel Version6.14 Updaterc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.098
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://git.kernel.org/stable/c/2b3878baf90918a361a3dfd3513025100b1b40b6
Patch
https://git.kernel.org/stable/c/62ab1ae5511c59b5f0bf550136ff321331adca9f
Patch
https://git.kernel.org/stable/c/6c18f5eb2043ebf4674c08a9690218dc818a11ab
Patch
https://git.kernel.org/stable/c/d8d99c3b5c485f339864aeaa29f76269cc0ea975
Patch
https://git.kernel.org/stable/c/dfe25c554daa12ee26eb3540bbded57733ed5d9c