CVE-2025-37891

What it actually does

The ALSA UMP conversion function from MIDI 1.0 uses a fixed 4-byte internal buffer for packet data but SysEx messages require up to 6 bytes in do_convert_to_ump(), resulting in a buffer overflow that corrupts adjacent kernel memory.

Why it matters to the business

Linux systems handling MIDI devices may crash or allow memory corruption during audio processing, disrupting multimedia applications and potentially enabling local privilege escalation on affected kernels.

How an attack unfolds

An attacker sends a crafted SysEx MIDI 1.0 message exceeding 4 bytes to a vulnerable ALSA UMP conversion path; the oversized data overflows the buffer in the conversion function, corrupting memory and potentially leading to code execution or denial of service.

How to fix it

Update the Linux kernel to the fixed commit ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec or later stable releases containing this change; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel source includes commit ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec; test conversion of 6-byte SysEx messages without kernel warnings or crashes.

Typical attack path

1. Gain ability to deliver MIDI 1.0 SysEx messages to the target system (local device, software loopback, or user-space input)
2. Craft and transmit a SysEx message of 5-6 bytes to trigger the conversion path
3. Overflow the 4-byte buffer in the UMP conversion function
4. Corrupt adjacent kernel memory to achieve crash or code execution

How to detect it

Review kernel logs for ALSA UMP conversion errors or oops triggered during MIDI SysEx processing; correlate with unexpected process crashes in audio subsystems.

What your security team should do

• Prioritize kernel upgrade on any system exposing ALSA MIDI/UMP interfaces
• Restrict untrusted MIDI device or software input until patched
• Monitor kernel logs for ALSA UMP buffer-related oops or warnings
• Apply the fix across all stable kernel trees used in production audio workloads