CVE-2026-43169

In the Linux kernel, the following vulnerability has been resolved:

drm/buddy: Prevent BUG_ON by validating rounded allocation

When DRMBUDDYCONTIGUOUSALLOCATION is set, the requested size is rounded up to the next power-of-two via rounduppowoftwo(). Similarly, for non-contiguous allocations with large minblocksize, the size is aligned up via roundup(). Both operations can produce a rounded size that exceeds mm->size, which later triggers BUGON(order > mm->max_order).

Example scenarios: - 9G CONTIGUOUS allocation on 10G VRAM memory: rounduppowoftwo(9G) = 16G > 10G - 9G allocation with 8G minblocksize on 10G VRAM memory: roundup(9G, 8G) = 16G > 10G

Fix this by checking the rounded size against mm->size. For non-contiguous or range allocations where size > mm->size is invalid, return -EINVAL immediately. For contiguous allocations without range restrictions, allow the request to fall through to the existing _alloccontigtryharder() fallback.

This ensures invalid user input returns an error or uses the fallback path instead of hitting BUG_ON.

v2: (Matt A) - Add Fixes, Cc stable, and Closes tags for context