CVE-2025-71286: Memory Allocation Bug in SOF Firmware

The core of this vulnerability lies in the ipc4-topology module's handling of bytes controls. The code incorrectly calculates the size needed to allocate memory for these controls, resulting in an undersized allocation. An attacker could potentially trigger this condition by crafting specific audio processing requests that exploit the memory allocation error. This could lead to a denial-of-service (DoS) attack, crashing the audio subsystem or even the entire kernel. While direct data exfiltration is unlikely, the disruption of audio functionality could have significant consequences for systems relying on audio input or output, such as embedded devices, multimedia servers, and VoIP systems. The blast radius is primarily limited to the affected audio subsystem, but a kernel crash could impact the entire system.

1. Published2026-05-06
2. Modified2026-05-11
3. EPSS updated2026-05-13

The primary mitigation for CVE-2025-71286 is to upgrade the Linux kernel to version a653820700b81c9e6f05ac23b7969ecec1a18e85 or later, which includes the corrected memory allocation logic. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider temporarily disabling the affected SOF features or implementing stricter input validation on audio processing requests. While a WAF or proxy is unlikely to directly mitigate this kernel-level vulnerability, ensuring proper firewall rules and network segmentation can limit potential attack vectors. After upgrading the kernel, confirm the fix by attempting to reproduce the vulnerability scenario (e.g., sending a crafted audio processing request) and verifying that the system remains stable.