Log in Start free

Vulnerability · Published May 19, 2025 · Assigned by Linux

CVE-2025-37891ALSA: ump: Fix buffer overflow at UMP SysEx message conversion

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix buffer overflow at UMP SysEx message conversion The conversion function from MIDI 1.0 to UMP packet contains an internal buffer to keep the incoming MIDI bytes, and its size is 4, as it was supposed to be the max size for a MIDI1 UMP packet data. However, the implementation overlooked that SysEx is handled in a different format, and it can be up to 6 bytes, as found in do_convert_to_ump(). It leads eventually to a buffer overflow, and may corrupt the memory when a longer SysEx message is received. The fix is simply to extend the buffer size to 6 to fit with the SysEx UMP message.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.29-1DEBIAN-CVE-2025-37891
Debian:14linux6.12.29-1DEBIAN-CVE-2025-37891
Ubuntu:24.04:LTSlinux6.8.0-100.100UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-aws6.8.0-1046.49UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1009.9~24.04.1USN-7665-2
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1009.9~24.04.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-azure6.8.0-1046.52UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1051.57~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1046.53UBUNTU-CVE-2025-37891
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1046.53~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-gcp6.8.0-1047.50UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-gcp-6.146.14.0-1011.11~24.04.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1047.50~22.04.2UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-gke6.8.0-1043.48UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1030.33UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-ibm6.8.0-1044.44UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1044.44~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-100.100.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-100.100.1~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1046.49UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1046.49.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1020.20UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1007.7UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1007.7USN-7650-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oracle6.8.0-1043.44UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-oracle-6.146.14.0-1009.9~24.04.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1043.44~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-raspi6.8.0-1047.51UBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-riscv-6.146.14.0-24.24.1~24.04.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-37891
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-37891
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1023.24UBUNTU-CVE-2025-37891

Affected products (as reported)

VendorProductVersions
Linux Linux 0b5288f5fe63eab687c14e5940b9e0d532b129f2 – before ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec0b5288f5fe63eab687c14e5940b9e0d532b129f2 – before 226beac5605afbb33f8782148d188b64396145a40b5288f5fe63eab687c14e5940b9e0d532b129f2 – before 42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe0b5288f5fe63eab687c14e5940b9e0d532b129f2 – before 56f1f30e6795b890463d9b20b11e576adf5a2f77
Linux Linux 6.5

References