CVE-2025-37891

CVE-2025-37891 is a buffer overflow vulnerability found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) UMP (Universal MIDI Packet) subsystem. Specifically, the issue lies within the MIDI 1.0 to UMP packet conversion function. The internal buffer, intended to hold incoming MIDI bytes, is only 4 bytes in size. This buffer size is insufficient for handling SysEx messages, which can be up to 6 bytes long. Consequently, when a SysEx message exceeding 4 bytes is received, a buffer overflow occurs, potentially leading to memory corruption. A patch has been implemented to resolve this vulnerability by extending the buffer size to 6 bytes to properly accommodate SysEx UMP messages.