drm/buddy: Prevent BUG_ON by validating rounded allocation (Linux Linux)

CVE-2026-43169
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.13 % · percentile 2 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Analyzed

Description

In the Linux kernel, the following vulnerability has been resolved: drm/buddy: Prevent BUG_ON by validating rounded allocation When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Similarly, for non-contiguous allocations with large min_block_size, the size is aligned up via round_up(). Both operations can produce a rounded size that exceeds mm->size, which later triggers BUG_ON(order > mm->max_order). Example scenarios: - 9G CONTIGUOUS allocation on 10G VRAM memory: roundup_pow_of_two(9G) = 16G > 10G - 9G allocation with 8G min_block_size on 10G VRAM memory: round_up(9G, 8G) = 16G > 10G Fix this by checking the rounded size against mm->size. For non-contiguous or range allocations where size > mm->size is invalid, return -EINVAL immediately. For contiguous allocations without range restrictions, allow the request to fall through to the existing __alloc_contig_try_harder() fallback. This ensures invalid user input returns an error or uses the fallback path instead of hitting BUG_ON. v2: (Matt A) - Add Fixes, Cc stable, and Closes tags for context

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 0a1844bf0b532d84324453374ad6845f64066c28 < d764b8dd420098a4d253b8a5b27568c897edb2cf ; affected 0a1844bf0b532d84324453374ad6845f64066c28 < 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061 ; affected 0a1844bf0b532d84324453374ad6845f64066c28 < ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727 ; affected 0a1844bf0b532d84324453374ad6845f64066c28 < 5488a29596cdba93a60a79398dc9b69d5bdadf92
Linux · Linuxaffected 6.7 ; unaffected 0 < 6.7 ; unaffected 6.12.75 ≤ 6.12.* ; unaffected 6.18.16 ≤ 6.18.* ; unaffected 6.19.6 ≤ 6.19.* ; unaffected 7.0 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD