cbcvebase.
CVE-2025-37891
published 2025-05-19

CVE-2025-37891: In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from…

PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
11.6th percentile
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementation overlooked that SysEx is handled in a different format, and it can be up to 6 bytes, as found in do_convert_to_ump(). It leads eventually to a buffer overflow, and may corrupt the memory when a longer SysEx message is received. The fix is simply to extend the buffer size to 6 to fit with the SysEx UMP message.

Affected

41 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.29-1 (forky)linux 6.12.29-1 (forky)
linuxlinux
linuxlinux>= 0b5288f5fe63eab687c14e5940b9e0d532b129f2 < ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ecce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec
linuxlinux>= 0b5288f5fe63eab687c14e5940b9e0d532b129f2 < 226beac5605afbb33f8782148d188b64396145a4226beac5605afbb33f8782148d188b64396145a4
linuxlinux>= 0b5288f5fe63eab687c14e5940b9e0d532b129f2 < 42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe
linuxlinux>= 0b5288f5fe63eab687c14e5940b9e0d532b129f2 < 56f1f30e6795b890463d9b20b11e576adf5a2f7756f1f30e6795b890463d9b20b11e576adf5a2f77
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.29-16.12.29-1
linuxlinux_kernel>= 0 < 6.12.29-16.12.29-1
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 0 < 6.14.0-24.246.14.0-24.24
linuxlinux_kernel>= 6.13 < 6.14.66.14.6
linuxlinux_kernel>= 6.5 < 6.6.906.6.90
linuxlinux_kernel>= 6.7 < 6.12.286.12.28
msrcazl3_kernel_6.6.85.1-4_on_azure_linux_3.0
msrcazl3_kernel_6.6.92.2-1_on_azure_linux_3.0
msrcazl3_mozjs_102.15.1-1_on_azure_linux_3.0
msrcazl3_python-pip_24.2-2_on_azure_linux_3.0
msrcazl3_python-urllib3_2.0.7-1_on_azure_linux_3.0
msrcazl3_python3_3.12.3-5_on_azure_linux_3.0
msrcazl3_tensorflow_2.16.1-9_on_azure_linux_3.0
msrcazure_linux_3.0_arm

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc5.5MEDIUM
vendor_oracle4.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.