CVE-2026-43169: Linux Kernel DRM Buddy DoS Vulnerability

CVE-2026-43169 Overview

CVE-2026-43169 is a Linux kernel vulnerability in the drm/buddy memory allocator. The flaw resides in how the allocator handles size rounding for contiguous and large min_block_size allocations. When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). For non-contiguous allocations with a large min_block_size, the size is aligned via round_up(). Both paths can produce a rounded size that exceeds mm->size, which then triggers BUG_ON(order > mm->max_order) and crashes the kernel.

Critical Impact
A local user able to request DRM buddy allocator sizes can trigger a kernel BUG_ON, resulting in a denial-of-service condition on systems using affected GPU memory management code.

Affected Products

Linux kernel versions containing the drm/buddy allocator prior to the patched commits
Systems using DRM drivers that rely on the buddy allocator for VRAM management
Distributions shipping unpatched upstream kernels

Discovery Timeline

2026-05-06 - CVE-2026-43169 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43169

Vulnerability Analysis

The issue affects the Direct Rendering Manager (DRM) buddy memory allocator used by GPU drivers to manage VRAM. The allocator validates that an allocation order does not exceed mm->max_order via BUG_ON(order > mm->max_order). However, prior code paths transform the caller-supplied size before this check without verifying the rounded value against the total managed memory mm->size.

Two concrete scenarios demonstrate the failure. A 9 GiB contiguous allocation on a 10 GiB VRAM pool results in roundup_pow_of_two(9G) = 16G, which exceeds the 10 GiB pool. A 9 GiB allocation with an 8 GiB min_block_size on the same 10 GiB pool produces round_up(9G, 8G) = 16G. In both cases, the resulting order surpasses mm->max_order, hitting the BUG_ON and panicking the kernel.

This is a kernel denial-of-service issue rooted in missing input validation on rounded allocation sizes. It does not appear to permit memory corruption, privilege escalation, or information disclosure based on the available patch description.

Root Cause

The root cause is improper input validation following arithmetic rounding. The allocator trusted that rounded sizes would remain within the bounds of the managed memory pool. When callers passed sizes that, after roundup_pow_of_two() or round_up(), exceeded mm->size, the kernel reached an assertion that was never intended for runtime-reachable conditions.

Attack Vector

A local user or process with the ability to issue DRM buddy allocations — typically through GPU memory allocation ioctls exposed by an affected DRM driver — can craft a request that triggers the rounded-size overflow. The fix returns -EINVAL for non-contiguous or range allocations where the rounded size exceeds mm->size, and routes contiguous requests without range restrictions to the __alloc_contig_try_harder() fallback rather than the assertion path.

No public proof-of-concept or exploit code is associated with this CVE. The vulnerability requires local access and the ability to invoke DRM allocation paths.

Detection Methods for CVE-2026-43169

Indicators of Compromise

Kernel panic messages referencing BUG_ON in drm/buddy allocator code paths
Unexpected system crashes on hosts running GPU workloads with large allocation requests
Repeated DRM allocation failures or crashes correlated with a specific local process

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for BUG_ON traces involving drm_buddy symbols
Track kernel version inventory across Linux endpoints to identify hosts running unpatched builds
Correlate process-level GPU allocation activity with crash events in centralized logging

Monitoring Recommendations

Forward kernel ring buffer logs to a centralized log platform for crash pattern analysis
Alert on kernel oops or panic events that include DRM buddy allocator stack frames
Audit which local users and containers have access to DRM device nodes such as /dev/dri/*

How to Mitigate CVE-2026-43169

Immediate Actions Required

Apply the upstream Linux kernel patches that validate rounded allocation size against mm->size
Update to a distribution kernel that incorporates the referenced stable commits
Restrict access to DRM device nodes to trusted users and workloads where feasible

Patch Information

The fix validates the rounded allocation size against mm->size before reaching BUG_ON. For non-contiguous or range allocations where size > mm->size is invalid, the allocator now returns -EINVAL. For contiguous allocations without range restrictions, the request falls through to the existing __alloc_contig_try_harder() fallback path.

Reference commits include Linux Kernel Commit 5488a295, Linux Kernel Commit 6236c1cd, Linux Kernel Commit d764b8dd, and Linux Kernel Commit ecb32c60.

Workarounds

Limit local access to DRM render and card device nodes via group permissions and namespaces
Constrain untrusted workloads from invoking DRM ioctls through seccomp or container policy
Where patching is not yet possible, avoid exposing GPU passthrough to untrusted guests

bash

# Verify running kernel includes the drm/buddy fix
uname -r

# Inspect DRM device permissions
ls -l /dev/dri/

# Restrict /dev/dri access to the video/render group only
sudo chgrp render /dev/dri/renderD*
sudo chmod 0660 /dev/dri/renderD*