Linux Kernel EUVD-2025-209677

The vulnerability exists in the ASoC (ALSA System on Chip) SOF ipc4-topology kernel subsystem, which handles audio topology configuration through the IPC4 (Inter-Process Communication version 4) protocol. The audio control data structure requires two components: the kernel-only sof_ipc4_control_data structure (component 1) and the sof_abi_hdr plus payload (component 2, whose size is specified by max_size from topology). The bug occurs because memory allocation for scontrol->ipc_control_data only accounts for component 2, omitting component 1, resulting in an undersized buffer allocation. When bytes controls are processed, the kernel writes beyond allocated memory boundaries, leading to heap corruption or denial of service. This affects systems with SOF audio firmware enabled, particularly those using Intel DSP-based audio controllers or ARM ADSP configurations that depend on topology-driven audio initialization.