Back
CVE-2025-37803udmabuf: fix a buf size overflow issue during udmabuf creation
- 7.8HighCVSS base score
- 0.25%Exploitation in 30 daysEPSS · top 83% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix a buf size overflow issue during udmabuf creation by casting size_limit_mb to u64 when calculate pglimit.
Timeline
ID reserved
By Linux
- 22 days later
· 22 days later
Published
- 12 months later
· 12 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 83% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < e84a08fc7e25cdad5d9a3def42cc770ff711193f
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 13fe12c037b470321436deec393030c6153cfeb9
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 373512760e13fdaa726faa9502d0f5be2abb3d33
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 3f6c9d66e0f8eb9679b57913aa64b4d2266f6fbe
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < b2ff4e9c599b000833d16a917f519aa2e4a75de2
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 29b65a3171a49c9b69f31035146be966cec40b7a
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 2b8419c6ecf69007dcff54ea0b9f0b215282c55a
- affected fbb0de795078190a9834b3409e4b009cfb18a6d4 – < 021ba7f1babd029e714d13a6bf2571b08af96d0f
- affected 4.20
- unaffected < 4.20
- unaffected 5.4.293 – ≤ 5.4.*
- unaffected 5.10.237 – ≤ 5.10.*
- unaffected 5.15.181 – ≤ 5.15.*
- unaffected 6.1.136 – ≤ 6.1.*
- unaffected 6.6.89 – ≤ 6.6.*
- unaffected 6.12.57 – ≤ 6.12.*
- unaffected 6.14.5 – ≤ 6.14.*
- unaffected 6.15 – ≤ *
References
References10
- https://git.kernel.org/stable/c/e84a08fc7e25cdad5d9a3def42cc770ff711193f (opens in a new tab)
- https://git.kernel.org/stable/c/13fe12c037b470321436deec393030c6153cfeb9 (opens in a new tab)
- https://git.kernel.org/stable/c/373512760e13fdaa726faa9502d0f5be2abb3d33 (opens in a new tab)
- https://git.kernel.org/stable/c/3f6c9d66e0f8eb9679b57913aa64b4d2266f6fbe (opens in a new tab)
- https://git.kernel.org/stable/c/b2ff4e9c599b000833d16a917f519aa2e4a75de2 (opens in a new tab)
- https://git.kernel.org/stable/c/29b65a3171a49c9b69f31035146be966cec40b7a (opens in a new tab)
- https://git.kernel.org/stable/c/2b8419c6ecf69007dcff54ea0b9f0b215282c55a (opens in a new tab)
- https://git.kernel.org/stable/c/021ba7f1babd029e714d13a6bf2571b08af96d0f (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-13992 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-37803)Record last updated .