CVE-2025-21870

A flaw was found in the Linux kernel's Sound Open Firmware (SOF) audio subsystem. A local user can cause a Denial of Service (DoS) and crash the system due to a NULL pointer dereference during audio pipeline setup. This issue occurs when searching for audio stream copier components, where improper validation allows non-digital audio interface (DAI) widgets sharing the same stream name to be processed without required internal data.

This vulnerability is rated as Moderate because exploitation requires local access on systems configured with Sound Open Firmware hardware, limiting the impact to a denial of service without compromising data confidentiality or integrity. Enterprise Red Hat Enterprise Linux installations are typically deployed in headless server environments without active sound hardware or SOF audio pipelines, limiting overall exposure. Successful exploitation requires specific topology configurations involving Audio Link Hub copiers, making accidental or unauthorized triggering unlikely under standard operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.