CVE-2025-71286

A flaw was found in the Linux kernel, specifically within the Advanced Linux Sound Architecture (ALSA) Sound Open Firmware (SOF) ipc4-topology component. An incorrect calculation of memory allocation size for bytes controls can occur. This memory allocation error could lead to memory corruption, potentially allowing a local attacker to cause a denial of service, leading to system instability or a crash.

This vulnerability is rated as Moderate impact because exploitation requires local access to a host equipped with Sound Open Firmware (SOF) audio hardware, limiting the attack scope primarily to a local denial of service. Typical Red Hat Enterprise Linux server and virtualized environments do not utilize or initialize SOF audio hardware by default. On affected desktop or workstation configurations where this hardware is actively configured, a local unprivileged user could trigger memory corruption leading to a kernel crash, but cannot achieve remote code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.