VulnerabilityPublished 6 May 2026Updated 6 Nov 2026

CVE-2026-43169: Linux kernel · drm/buddy: Prevent BUG_ON by validating rounded allocation

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 15:51 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727, d764b8dd420098a4d253b8a5b27568c897edb2cf, 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 6 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727, d764b8dd420098a4d253b8a5b27568c897edb2cf, 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061 or 5488a29596cdba93a60a79398dc9b69d5bdadf92.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 0a1844bf0b532d84324453374ad6845f64066c28, < ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727	Fixed in ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727
LinuxLinux	Affected ≥ 0a1844bf0b532d84324453374ad6845f64066c28, < d764b8dd420098a4d253b8a5b27568c897edb2cf	Fixed in d764b8dd420098a4d253b8a5b27568c897edb2cf
LinuxLinux	Affected ≥ 0a1844bf0b532d84324453374ad6845f64066c28, < 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061	Fixed in 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061
LinuxLinux	Affected ≥ 0a1844bf0b532d84324453374ad6845f64066c28, < 5488a29596cdba93a60a79398dc9b69d5bdadf92	Fixed in 5488a29596cdba93a60a79398dc9b69d5bdadf92
LinuxLinux	Affected =6.7	Fixed in–

AI-suggested

A fix is available in the Linux kernel as indicated by the fixed commit versions. Users should update to a kernel version that includes the fix (commits ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727, d764b8dd420098a4d253b8a5b27568c897edb2cf, 6236c1cd9fdf433d39ed28b2491ccdfe7ae95061, or 5488a29596cdba93a60a79398dc9b69d5bdadf92). No additional mitigation is required as the patch ensures invalid allocation requests are handled gracefully without crashing the kernel.

Description

CVE-2026-43169 is a vulnerability in the Linux kernel's DRM buddy allocator where certain memory allocation requests can cause a kernel BUG_ON due to improper validation of rounded allocation sizes. Specifically, when contiguous allocation or large minimum block sizes cause the requested size to round up beyond the available memory size, the kernel triggers a BUG_ON, leading to a kernel panic. The fix involves validating the rounded size against the available memory size and returning an error or using a fallback allocation path instead of crashing.

Impact

Exploitation of this vulnerability can cause the Linux kernel to hit a BUG_ON condition, resulting in a kernel panic and system crash. This impacts system stability and availability but does not directly indicate privilege escalation or data corruption. The issue arises from invalid user input leading to improper memory allocation size rounding.

Summary

The Linux kernel's drm/buddy allocator had a flaw where allocation requests with DRM_BUDDY_CONTIGUOUS_ALLOCATION set or large min_block_size could be rounded up to a size exceeding the available memory (mm->size). This caused a BUG_ON(order > mm->max_order) kernel panic. The vulnerability was fixed by adding checks to validate the rounded size against mm->size. For invalid sizes in non-contiguous or range allocations, the allocator returns -EINVAL immediately. For contiguous allocations without range restrictions, the request falls back to __alloc_contig_try_harder() instead of crashing. This prevents kernel panics caused by invalid user input.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 15:51 UTC

Technical details

References

Community reviews

Related threats