CVE-2026-43137

What it actually does

This is a local denial-of-service flaw in the Linux kernel's Intel Sound Open Firmware (SOF) HDA audio path. When the machine driver and audio topology define mismatched DAI links, the kernel may attempt to use a playback or capture widget that was never initialized, causing a NULL pointer dereference in snd_sof_intel_hda_common, specifically around hda_dai_get_ops. The likely result is a kernel oops, audio subsystem failure, or system crash depending on kernel panic settings and runtime conditions. The issue does not provide confidentiality or integrity impact by itself and is not remotely exploitable under the published CVSS vector.

Why it matters to the business

Affected Linux systems with Intel HDA/SOF audio support may be crashed or destabilized by a local user or by software that can trigger the vulnerable audio topology path. For desktops, laptops, kiosks, thin clients, developer workstations, and embedded Linux devices using Intel audio, this can cause user disruption, service interruption, unscheduled reboots, and support burden. The low EPSS score, unchanged EPSS trend, absence from CISA KEV, and lack of known exploit maturity indicate low internet-scale exploitation urgency, but organizations should still remediate through normal kernel update cycles, especially where local multi-user access or untrusted local code execution is possible.

How an attack unfolds

An attacker first needs local access to an affected Linux system. The attacker then attempts to exercise the Intel SOF HDA audio path under conditions where the loaded machine driver DAI links do not match the SOF topology, such as a broken, incompatible, or manipulated topology configuration involving playback, capture, or loopback capture paths. When the vulnerable kernel code resolves operations for a DAI whose widget pointer was not set, it dereferences a NULL pointer in hda_dai_get_ops. This can generate a kernel oops and may crash the system or disable the affected audio path. Practical exploitation depends on the system using the affected Intel SOF HDA driver path and on the attacker's ability to trigger or influence the mismatched topology condition; there is no indication of public weaponization or ransomware use.

How to fix it

Apply the Linux kernel update provided by the relevant distribution or kernel vendor that includes the ASoC SOF Intel HDA NULL pointer dereference fix. No universal fixed package version was provided in the input, so use vendor advisories and package metadata to identify the corrected kernel build for each supported distribution. After updating, reboot into the fixed kernel and remove or block booting into older vulnerable kernels where operationally feasible. As temporary risk reduction, restrict local interactive access, limit execution of untrusted local code, avoid custom or unvalidated SOF topology files, and consider disabling affected Intel SOF HDA audio functionality on systems where audio is not required. Do not rely on mitigation alone for long-lived systems; kernel replacement is the appropriate fix.

How to confirm the fix worked

Confirm exposure by checking whether the system runs an affected Linux kernel with Intel SOF HDA audio support loaded. Useful commands include uname -a, distribution package queries for the installed kernel, lsmod for snd_sof_intel_hda_common, snd_sof_pci_intel_* and related modules, and dmesg or journalctl -k for SOF/HDA initialization messages. Confirm remediation by verifying the running kernel version matches a vendor-fixed build, not merely that the package is installed. Reboot after patching and re-check uname -r. Validate stability by exercising normal playback, capture, and loopback/audio initialization paths and confirming there are no kernel oops messages referencing hda_dai_get_ops, snd_sof_intel_hda_common, NULL pointer dereference, or ASoC SOF topology failures.

Typical attack path

1. Gain local access to an affected Linux system, typically as an unprivileged or low-privileged user.
2. Confirm the system uses Intel HDA/SOF audio components and loads modules such as snd_sof_intel_hda_common or related SOF HDA drivers.
3. Trigger audio initialization or stream setup involving playback, capture, or loopback capture paths where the machine driver and topology are inconsistent.
4. Cause the kernel to enter the vulnerable hda_dai_get_ops path with an unset widget pointer.
5. Induce a NULL pointer dereference, resulting in a kernel oops, audio subsystem failure, or host crash depending on system configuration.

How to detect it

To determine whether this was already exploited or triggered, review kernel logs and persistent system journals for oops, panic, or crash entries involving Intel SOF HDA audio. Primary sources are journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, dmesg output, pstore crash logs under /sys/fs/pstore, kdump/vmcore records, and endpoint telemetry that collects kernel crash events. Look for NULL pointer dereference messages where the instruction pointer references hda_dai_get_ops and the loaded module is snd_sof_intel_hda_common. Correlate suspicious events with local user sessions, recently executed audio tools, container workloads with audio device access, changes to firmware or topology files under /lib/firmware, and repeated crashes during audio stream initialization. Because exploitation produces a denial-of-service condition rather than a durable implant, there may be no persistent attacker artifact beyond crash logs, command history, process execution telemetry, and file modification evidence around SOF topology or firmware files.

• BUG: kernel NULL pointer dereference
• RIP: 0010:hda_dai_get_ops
• hda_dai_get_ops.isra.0
• snd_sof_intel_hda_common
• ASoC: SOF: Intel: hda
• sof-audio-pci-intel-hda
• sof-audio-pci-intel-tgl
• sof-audio-pci-intel-cnl
• sof-audio-pci-intel-icl
• sof-audio-pci-intel-apl
• sof-audio-pci-intel-cfl
• sof-audio-pci-intel-icl
• sof-audio-pci-intel-mtl
• /lib/firmware/intel/sof-tplg/
• /lib/firmware/intel/sof/
• widget is not set
• topology is broken
• DAI links in the machine driver and the topology
• loopback capture for echo reference

What your security team should do

• Prioritize patching multi-user Linux systems, workstations running untrusted code, kiosks, shared developer machines, and embedded endpoints that use Intel SOF HDA audio.
• Track distribution-specific kernel advisories for this vulnerability and deploy the first vendor-fixed kernel available; fixed versions were not provided in the source data.
• Reboot systems after the kernel update and verify the running kernel, because installing a kernel package without rebooting leaves the vulnerable kernel active.
• Search kernel logs for prior crashes or oops events involving hda_dai_get_ops, snd_sof_intel_hda_common, SOF topology mismatch, or NULL pointer dereference.
• Restrict local shell access and untrusted local code execution on systems that cannot be patched promptly.
• Avoid deploying custom, experimental, or mismatched SOF topology files unless they are validated against the installed kernel and machine driver.
• Consider disabling unused audio hardware or SOF HDA driver loading on sensitive servers or appliances where audio is unnecessary.
• Because EPSS is very low, KEV is false, and no public exploit maturity is reported, handle this through routine vulnerability management unless local denial-of-service risk is operationally significant.