This vulnerability occurs in the Linux kernel driver for DRM when large contiguous or non‑contiguous memory allocations are requested. The requested size is rounded up to the next power‑of‑two or aligned up to the minimum block size, and if that rounded value exceeds the size of the memory region (mm->size) a BUG_ON is triggered during allocation. The resulting kernel panic results in a system crash, presenting a denial‑of‑service attack surface. The weakness is a failure to validate allocation bounds before proceeding to the kernel allocation path. Based on the description, it is inferred that the vulnerability is directly related to user‑supplied allocation size parameters and the kernel’s rounding logic.

Any Linux kernel that includes the drm/buddy components and supports the DRM_BUDDY_CONTIGUOUS_ALLOCATION feature is affected, regardless of distribution. The specific kernel versions are not enumerated in the data, so all kernels prior to the patch that contains the round‑size validation fix are vulnerable.

The exploit is local to processes that can issue DRM allocation requests, such as graphics applications or drivers. Because the bug leads to an unconditional crash, an attacker with the ability to trigger the allocation path can cause a denial‑of‑service. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so the historical exploit probability and impact classification remain unknown. With a CVSS score of 5.5, the vulnerability is classified as medium severity, indicating moderate risk of system disruption. The likely attack vector is local, as the bug requires a process to request an oversized buffer. Based on the description, it is inferred that the attacker must have permission to influence graphics allocation requests or directly load a driver to trigger the rounding bug. The patch adds a bounds check before the allocation, returning -EINVAL for requests that would exceed the memory region, thereby eliminating the crash. In path implementations that lack a range restriction, the request is redirected to a fallback that handles oversized allocations safely.