CVE-2025-21847: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming that it is not NULL if sps->stream is NULL is incorrect and can lead to NULL pointer dereference.

Affected products

• Linux Linux Kernel: from 6.3, before 6.6.80 (fixed in 6.6.80); from 6.7, before 6.12.17 (fixed in 6.12.17); from 6.13, before 6.13.5 (fixed in 6.13.5); version 6.14 only

Published 2025-03-12. Last modified 2026-06-17.