CVE-2025-37803: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-37803 Overview

CVE-2025-37803 is a buffer size overflow vulnerability in the Linux kernel's udmabuf driver. The flaw occurs during udmabuf creation because the size_limit_mb value is not cast to u64 before calculating pglimit. This produces an integer overflow that undermines the intended page-count limit check. A local, authenticated user can trigger the condition through the udmabuf device interface to corrupt kernel memory state. The upstream fix casts size_limit_mb to u64 before computing pglimit. The vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact
Local users with access to the udmabuf device can trigger a size-limit integer overflow that may lead to memory corruption, denial of service, or local privilege escalation on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Linux Kernel 6.15-rc1
Debian LTS distributions shipping affected kernels

Discovery Timeline

2025-05-08 - CVE-2025-37803 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-37803

Vulnerability Analysis

The udmabuf driver exposes a user-space interface for creating DMA buffers backed by memfd pages. During buffer creation, the driver calculates a page-count limit (pglimit) from the module parameter size_limit_mb, which represents the maximum allowed buffer size in megabytes.

Before the fix, the arithmetic converting megabytes to pages was performed using a narrower integer type. On systems where size_limit_mb multiplied by the megabyte-to-page conversion factor exceeds the range of the intermediate integer, the calculation wraps around. The resulting pglimit value is far smaller than intended, or wraps to a value that bypasses the guard entirely.

An attacker who invokes the udmabuf creation ioctl can allocate buffers exceeding the enforced size limit. This leads to abnormal memory pressure, memory corruption, or exploitable kernel state, aligning with the impact reflected in the CVSS Confidentiality, Integrity, and Availability metrics.

Root Cause

The root cause is a missing type promotion. The size_limit_mb variable was used directly in a multiplication whose result overflowed before assignment to a wider type. Casting size_limit_mb to u64 prior to the multiplication ensures the arithmetic is performed in 64-bit width, preventing wraparound and preserving the intended size guard.

Attack Vector

Exploitation requires local access with permission to open the /dev/udmabuf character device. The attacker issues the UDMABUF_CREATE or UDMABUF_CREATE_LIST ioctl with parameters crafted to trigger the overflow in the page-limit calculation. No user interaction is required beyond invoking the syscall path. The vulnerability is not remotely exploitable and does not require elevated privileges beyond access to the udmabuf device node.

Refer to the upstream fix commits for the exact patched code, including Kernel Git Commit e84a08f and related backports.

Detection Methods for CVE-2025-37803

Indicators of Compromise

Unexpected kernel oom-killer events or memory-pressure spikes on hosts exposing /dev/udmabuf to unprivileged users
Kernel log entries referencing udmabuf allocations that exceed the configured size_limit_mb value
Unusual crashes, panics, or slab corruption reports on kernels prior to the patched commits

Detection Strategies

Inventory running kernel versions and compare against the fixed commits listed in the Linux stable tree references
Monitor auditd or eBPF telemetry for processes opening /dev/udmabuf and issuing UDMABUF_CREATE ioctls
Alert on non-root processes performing large or repeated udmabuf allocations, especially where allocation sizes exceed configured limits

Monitoring Recommendations

Enable kernel taint and OOPS log forwarding to central logging for early identification of memory corruption
Track SUID or container escape indicators on systems where udmabuf is exposed inside containers
Correlate udmabuf ioctl activity with subsequent process crashes or privilege changes

How to Mitigate CVE-2025-37803

Immediate Actions Required

Apply the vendor-supplied kernel updates from your Linux distribution as soon as they are available
Restrict access to /dev/udmabuf so only trusted, privileged workloads can open the device
Audit container runtime configurations to ensure /dev/udmabuf is not exposed to untrusted workloads

Patch Information

The upstream fix is available in the Linux stable tree through commits including 021ba7f, 13fe12c, 2b8419c, 3735127, 3f6c9d6, b2ff4e9, and e84a08f. Debian users should follow Debian LTS Announcement #30 and Debian LTS Announcement #45 for backported packages.

Workarounds

Disable or unload the udmabuf kernel module where it is not required using rmmod udmabuf and blacklist it in /etc/modprobe.d/
Tighten file permissions on /dev/udmabuf so only root or a dedicated group can open the device
Lower the size_limit_mb module parameter to a conservative value to reduce the exploitable range until patches are applied

bash

# Configuration example
# Blacklist the udmabuf module until the kernel is patched
echo 'blacklist udmabuf' | sudo tee /etc/modprobe.d/disable-udmabuf.conf
sudo rmmod udmabuf 2>/dev/null || true

# Restrict device permissions if the module must remain loaded
sudo chmod 0600 /dev/udmabuf
sudo chown root:root /dev/udmabuf