{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/buddy: Prevent BUG_ON by validating rounded allocation  When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is rounded up to the next power-of-two via roundup_pow_of_two(). Similarly, for non-contiguous allocations with large min_block_size, the size is aligned up via round_up(). Both operations can produce a rounded size that exceeds mm-\u003esize, which later triggers BUG_ON(order \u003e mm-\u003emax_order).  Example scenarios: - 9G CONTIGUOUS allocation on 10G VRAM memory:   roundup_pow_of_two(9G) = 16G \u003e 10G - 9G allocation with 8G min_block_size on 10G VRAM memory:   round_up(9G, 8G) = 16G \u003e 10G  Fix this by checking the rounded size against mm-\u003esize. For non-contiguous or range allocations where size \u003e mm-\u003esize is invalid, return -EINVAL immediately. For contiguous allocations without range restrictions, allow the request to fall through to the existing __alloc_contig_try_harder() fallback.  This ensures invalid user input returns an error or uses the fallback path instead of hitting BUG_ON.  v2: (Matt A) - Add Fixes, Cc stable, and Closes tags for context",
  "id": "DEBIAN-CVE-2026-43169",
  "modified": "2026-09-14T16:47:31.204541597Z",
  "published": "2026-05-06T12:16:35.197Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43169"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43169"
  ]
}