CVE-2025-37803

A buffer-overflow vulnerability was found in the Linux kernel's udmabuf driver. The flaw occurs in the udmabuf_create() function, which calculates the page count limit (pglimit) using the variable size_limit_mb. This size variable can be misinterpreted as either 32-bit or 64-bit, resulting in incorrect page limit checks and allocating a larger DMA buffer than permitted. This issue can lead to memory corruption, system instability, and a denial of service.

An integer overflow in udmabuf_create can occur when computing the page limit from size_limit_mb using 32 bit arithmetic before shifting. This can cause pglimit to wrap and may break the intended buffer size enforcement, allowing a local user with access to the udmabuf device to request unexpectedly large allocations. The issue is not network reachable and does not imply memory corruption by itself. Impact is primarily denial of service via memory pressure or allocation failures.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.