CVE-2025-37927

What it actually does

Insufficient length validation when parsing HID and UID fields from ACPI IVRS tables allows a string longer than the 256-byte target buffers to overflow them.

Why it matters to the business

Systems running affected Linux kernels on AMD platforms with IOMMU enabled may experience crashes, memory corruption, or local privilege escalation; older Ubuntu LTS releases are widely deployed in servers and virtualized environments, increasing exposure.

How an attack unfolds

An attacker with the ability to supply a crafted ACPI IVRS table (via firmware, hypervisor, or physical access) triggers the parse_ivrs_acpihid function with oversized HID or UID strings; the flawed total-length check passes while the individual field copy overflows the static buffer, leading to adjacent memory corruption that can be leveraged for code execution.

How to fix it

Upgrade linux, linux-aws, linux-kvm, and linux-lts-xenial packages to the listed fixed versions (for example linux 3.11.0-12.19 on Ubuntu 14.04, 4.4.0-2.16 on Ubuntu 16.04, and 5.15.0-1073.79~20.04.1 on Ubuntu 20.04 AWS kernels) and reboot.

How to confirm the fix worked

Verify installed kernel package versions match or exceed the fixed releases; confirm the patch is present by inspecting the parse_ivrs_acpihid function for separate HID/UID length checks; test IOMMU initialization with a synthetic ACPI table containing maximum-length strings.

Typical attack path

1. Obtain ability to influence ACPI tables presented to the kernel
2. Craft an IVRS entry containing a HID or UID field exceeding 256 bytes
3. Trigger IOMMU initialization or ACPI parsing during boot or device enumeration
4. Exploit resulting buffer overflow to corrupt kernel memory and escalate privileges

How to detect it

Review kernel logs for buffer-overrun warnings or crashes in iommu/amd during early boot; correlate with unexpected ACPI table loads or device-enumeration failures on AMD platforms.

What your security team should do

• Prioritize kernel upgrades on all AMD IOMMU-enabled systems within the next maintenance window
• Restrict untrusted ACPI table sources in virtualized or cloud deployments
• Monitor for kernel oops or panic events referencing iommu/amd during boot
• Apply compensating controls such as disabling unused IOMMU features until patches are deployed