CVE-2025-40132

Vulnerability

In the Linux kernel's ASoC subsystem, the Intel SoundWire (sof_sdw) driver contains a NULL pointer dereference vulnerability in the create_sdw_dailink() function [1]. The code assumed that if include_sidecar is true, every codec on that SoundWire link has a valid add_sidecar callback pointer. However, other codecs on the same link may not provide this callback, leading to a jump to NULL [1].

Exploitation

An attacker would need to be able to influence the SoundWire topology or device configuration to create a scenario where a codec on a sidecar-included link lacks the add_sidecar callback. This may be triggered by hotplugging a malicious or non-compliant codec, or by manipulating device properties through firmware/ACPI tables. The exploitation is local, requiring some control over the system's audio hardware configuration.

Impact

Calling a NULL function pointer results in a kernel panic (oops), causing a denial of service (DoS). There is no evidence in the source that this can be leveraged for privilege escalation or code execution. The vulnerability affects systems using the Intel SoundWire interface with multiple codecs on a single link.

Mitigation

The fix was committed to the Linux kernel stable tree in commit 87cab86925b7fa4c1c977bc191ac549a3b23f0ea [1]. It adds a NULL check before calling the callback. Users should apply the latest stable kernel updates that include this fix.