CVE-2025-37927 Details
Description
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer which size is 256. The same applies to the hid string with length 13 and uid string with length 250. Check the length of hid and uid strings separately to prevent buffer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE.
A buffer overflow vulnerability has been identified in the Linux kernel's IOMMU/AMD component. This issue arises from a string parsing logic error that can lead to an overflow of HID or UID buffers. The vulnerability occurs because the comparison of the ACPI ID length against the total string length does not adequately account for the lengths of individual HID and UID buffers. For instance, a HID string length of 4 combined with a UID string length of 260 would result in an overflow, as the UID buffer can only accommodate 256 characters. Similarly, a HID string length of 13 and a UID string length of 250 would also cause an overflow. The vulnerability has been addressed by modifying the parsing logic to separately check the lengths of HID and UID strings, preventing the buffer overflow.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/10d901a95f8e766e5aa0bb9a983fb41271f64718 | kernel.org | Patch |
| https://git.kernel.org/stable/c/13d67528e1ae4486e9ab24b70122fab104c73c29 | kernel.org | Patch |
| https://git.kernel.org/stable/c/2b65060c84ee4d8dc64fae6d2728b528e9e832e1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/466d9da267079a8d3b69fa72dfa3a732e1f6dbb5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8dee308e4c01dea48fc104d37f92d5b58c50b96c | kernel.org | Patch |
| https://git.kernel.org/stable/c/a65ebfed65fa62797ec1f5f1dcf7adb157a2de1e | kernel.org | Patch |
| https://git.kernel.org/stable/c/c3f37faa71f5d26dd2144b3f2b14525ec8f5e41f | kernel.org | Patch |
| https://git.kernel.org/stable/c/c8bdfc0297965bb13fa439d36ca9c4f7c8447f0f | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html | CVE | Mailing ListThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.7, < 5.4.294 >= 5.5, < 5.10.238 >= 5.11, < 5.15.182 >= 5.16, < 6.1.138 >= 6.2, < 6.6.90 >= 6.7, < 6.12.28 >= 6.13, < 6.14.6 6.15 rc1 6.15 rc2 6.15 rc3 6.15 rc4 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 10, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Jun 4, 2025 | CVE Modified | kernel.org |
| May 20, 2025 | New CVE Received | kernel.org |