CVE-2025-37891: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-37891 Overview

CVE-2025-37891 is a buffer overflow vulnerability in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Universal MIDI Packet (UMP) subsystem. The flaw exists in the MIDI 1.0 to UMP packet conversion routine, which allocates an internal buffer sized for 4 bytes. System Exclusive (SysEx) messages can reach 6 bytes in the UMP format, exceeding the buffer in do_convert_to_ump(). Processing a longer SysEx message corrupts adjacent kernel memory. The issue is classified under [CWE-120] (Classic Buffer Overflow) and affects multiple Linux kernel branches, including 6.15 release candidates.

Critical Impact
A local attacker with access to a MIDI device interface can trigger kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 6.15-rc1, 6.15-rc2, 6.15-rc3, 6.15-rc4
Distributions shipping ALSA UMP support with vulnerable kernel versions

Discovery Timeline

2025-05-19 - CVE-2025-37891 published to NVD
2025-11-17 - Last updated in NVD database

Technical Details for CVE-2025-37891

Vulnerability Analysis

The ALSA UMP layer translates legacy MIDI 1.0 byte streams into UMP packet format used by MIDI 2.0 capable devices. The conversion path maintains a small intermediate buffer to accumulate incoming MIDI bytes before emitting a UMP packet. The original implementation sized this buffer at 4 bytes, matching the maximum size of a standard MIDI1 UMP packet payload.

SysEx messages follow a different encoding within the UMP container. A single SysEx UMP packet can carry up to 6 data bytes, exceeding the 4-byte buffer assumption. When the conversion function do_convert_to_ump() accumulates SysEx bytes, writes past index 3 overflow the buffer and corrupt adjacent stack or structure memory in kernel space.

Root Cause

The root cause is an incorrect buffer size constant in the MIDI1-to-UMP conversion code. The developer scoped the buffer to the maximum payload of a generic MIDI1 UMP message and did not account for SysEx packets, which the UMP specification allows to carry larger payloads. The fix extends the internal buffer to 6 bytes to accommodate the longest SysEx UMP message.

Attack Vector

Exploitation requires local access and the ability to send MIDI data to an ALSA sequencer or rawmidi device exposed by the kernel. An attacker with permission to open /dev/snd/seq or a /dev/snd/midi* node can submit a crafted SysEx stream that triggers the overflow during conversion. The overflow occurs in kernel context and can corrupt kernel memory, enabling denial of service or escalation of privileges depending on the surrounding memory layout and kernel hardening features.

The vulnerability manifests inside do_convert_to_ump() in the ALSA UMP code path. Verified patch commits are available at the Linux Kernel Commit 226beac5, Linux Kernel Commit 42ef48dd, Linux Kernel Commit 56f1f30e, and Linux Kernel Commit ce4f77be.

Detection Methods for CVE-2025-37891

Indicators of Compromise

Unexpected kernel oops or panic messages referencing snd_ump, do_convert_to_ump, or ALSA sequencer functions in dmesg.
KASAN or slab corruption reports involving ALSA UMP buffers.
Crashes or instability immediately following user-space MIDI activity by non-privileged processes.

Detection Strategies

Inventory running kernel versions against the patched commits and flag systems on vulnerable branches, including 6.15-rc1 through 6.15-rc4.
Monitor for unprivileged processes opening ALSA MIDI device nodes such as /dev/snd/seq and /dev/snd/midi* outside of expected audio workflows.
Enable kernel hardening features (KASAN, stack protector, CONFIG_FORTIFY_SOURCE) in test environments to surface overflow conditions during fuzzing of the UMP path.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central log platform and alert on kernel oops, BUG, or KASAN entries.
Audit auditd records for open() syscalls against ALSA MIDI device nodes by unexpected user accounts or container workloads.
Track package manager events for kernel updates to confirm patch deployment across the fleet.

How to Mitigate CVE-2025-37891

Immediate Actions Required

Apply the upstream stable kernel updates that include the four referenced fix commits to all affected systems.
Restrict access to ALSA MIDI device nodes by tightening group membership on the audio group and reviewing udev rules.
On systems that do not require MIDI, unload or blacklist the snd-seq and snd-ump modules to remove the attack surface.

Patch Information

The fix increases the internal conversion buffer from 4 to 6 bytes to fit the maximum SysEx UMP payload. Apply the kernel stable updates referenced in the Linux Kernel Commit 226beac5, Linux Kernel Commit 42ef48dd, Linux Kernel Commit 56f1f30e, and Linux Kernel Commit ce4f77be. Distribution vendors are publishing backports through their normal kernel update channels.

Workarounds

Blacklist ALSA UMP and sequencer modules on servers and containers that do not need MIDI functionality.
Remove untrusted users from the audio group to prevent direct access to MIDI device nodes.
Apply seccomp or LSM policies in container runtimes to deny access to /dev/snd/* for workloads that do not require sound devices.

bash

# Configuration example
# Blacklist ALSA sequencer and UMP modules until patched kernel is deployed
cat <<EOF | sudo tee /etc/modprobe.d/disable-alsa-ump.conf
blacklist snd_seq
blacklist snd_seq_device
blacklist snd_ump
EOF

# Apply by unloading currently loaded modules (if not in use)
sudo modprobe -r snd_ump snd_seq snd_seq_device 2>/dev/null || true

# Verify patched kernel after update
uname -r