CVE-2026-43137: Linux Kernel NULL Pointer Vulnerability

CVE-2026-43137 Overview

CVE-2026-43137 is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (ALSA System on Chip) Sound Open Firmware (SOF) Intel HDA driver. The flaw occurs when a mismatch exists between Digital Audio Interface (DAI) links defined in the machine driver and the audio topology. When the playback or capture widget is not set, particularly during loopback capture for echo reference using the dummy DAI link, the kernel triggers a NULL pointer dereference in hda_dai_get_ops. The issue has been resolved upstream through multiple stable branch commits.

Critical Impact
A broken or mismatched audio topology can cause a kernel crash through hda_dai_get_ops.isra.0 in the snd_sof_intel_hda_common module, resulting in local denial of service.

Affected Products

Linux kernel builds shipping the SOF Intel HDA common driver (snd_sof_intel_hda_common)
Systems using ASoC machine drivers with mismatched DAI link and topology configurations
Platforms relying on loopback capture for echo reference via the dummy DAI link

Discovery Timeline

2026-05-06 - CVE-2026-43137 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43137

Vulnerability Analysis

The vulnerability resides in the Linux kernel ASoC SOF Intel HDA driver, which manages audio routing on Intel platforms using Sound Open Firmware. The driver derives playback and capture widgets from the audio topology described by the firmware and pairs them with DAI links registered by the machine driver. When the topology omits a widget that the machine driver expects, the widget pointer remains NULL.

Functions such as hda_dai_get_ops subsequently dereference this NULL widget pointer without validation. The crash trace reported in the upstream fix points to hda_dai_get_ops.isra.0+0x14/0xa0 inside snd_sof_intel_hda_common. This is a classic NULL pointer dereference [CWE-476] reachable during normal audio stream setup on a misconfigured system.

Root Cause

The root cause is missing validation of the playback and capture widget pointers when DAI link mappings do not match the loaded topology. The dummy DAI link used for loopback capture and echo reference paths is particularly affected because it does not always have a corresponding widget in every topology. The original code assumed widget assignment had succeeded before downstream operations dereferenced the pointer.

Attack Vector

Exploitation requires a kernel running an SOF Intel HDA driver with a topology that does not match the registered DAI links. This is typically a configuration or firmware integration issue rather than a remote attack surface. A local user or an attacker who can influence the loaded firmware topology, kernel module parameters, or machine driver bindings can trigger the dereference and crash the kernel. The result is a denial of service on the affected host. Technical details are documented across the upstream fix commits referenced below.

// No verified exploit code is published. The crash signature reported upstream is:
// RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]

Detection Methods for CVE-2026-43137

Indicators of Compromise

Kernel oops or panic with RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 in snd_sof_intel_hda_common
Repeated BUG: kernel NULL pointer dereference entries in dmesg referencing the SOF Intel HDA module
Audio subsystem failures during stream setup involving loopback or echo reference paths

Detection Strategies

Monitor /var/log/kern.log and journalctl -k for NULL pointer dereference traces originating in snd_sof_intel_hda_common
Inventory Linux hosts running kernels predating the fixes in commits 10411f1, 16c5895, 42068f7, and 7750d78 and flag them as in scope
Correlate unexpected audio service restarts or crashes on Intel platforms with kernel ring buffer events

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on hda_dai_get_ops stack frames
Track package and kernel version drift across the fleet to confirm patched kernels are deployed consistently
Watch for repeated crashes on the same host, which indicates a persistent topology and DAI link mismatch rather than a transient fault

How to Mitigate CVE-2026-43137

Immediate Actions Required

Update affected Linux systems to a kernel version that includes the upstream fix from the referenced stable branch commits
Validate that the SOF firmware topology matches the DAI link definitions in the active machine driver before deployment
Restrict load of custom or unsigned audio firmware topologies to administrators only

Patch Information

The issue is resolved in the Linux kernel through the following upstream commits: Kernel Git Commit 10411f1, Kernel Git Commit 16c5895, Kernel Git Commit 42068f7, and Kernel Git Commit 7750d78. The fix returns an error when the playback or capture widget is not set rather than dereferencing the NULL pointer. Apply the kernel update from your Linux distribution as soon as it becomes available.

Workarounds

Avoid using audio topologies that reference the dummy DAI link for loopback capture on unpatched kernels
Disable or unload the snd_sof_intel_hda_common module on systems that do not require SOF audio until a patched kernel is installed
Standardize on vendor-supplied topology files that are known to match the machine driver DAI link configuration

bash

# Verify running kernel and SOF module on affected hosts
uname -r
modinfo snd_sof_intel_hda_common | grep -E '^(version|filename)'

# Temporarily prevent the module from loading on unpatched systems
echo 'blacklist snd_sof_intel_hda_common' | sudo tee /etc/modprobe.d/disable-sof-hda.conf
sudo update-initramfs -u