CVE-2026-43169

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/buddy: Prevent BUG_ON by validating rounded allocation

When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is

rounded up to the next power-of-two via roundup_pow_of_two().

Similarly, for non-contiguous allocations with large min_block_size,

the size is aligned up via round_up(). Both operations can produce a

rounded size that exceeds mm->size, which later triggers

BUG_ON(order > mm->max_order).

Example scenarios:

- 9G CONTIGUOUS allocation on 10G VRAM memory:

roundup_pow_of_two(9G) = 16G > 10G

- 9G allocation with 8G min_block_size on 10G VRAM memory:

round_up(9G, 8G) = 16G > 10G

Fix this by checking the rounded size against mm->size. For

non-contiguous or range allocations where size > mm->size is invalid,

return -EINVAL immediately. For contiguous allocations without range

restrictions, allow the request to fall through to the existing

__alloc_contig_try_harder() fallback.

This ensures invali

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References