This CVE fixes a misalignment bug in the buddy allocator's fallback path. When try_harder returns a memory run that isn't aligned to min_block_size, the allocator could hand out slabs that violate the alignment contract downstream code depends on. The v2 patch doesn't just reject misaligned candidates—it realigns them by freeing the misaligned run and reallocating at the guaranteed boundary. This preserves allocation accounting integrity and prevents the buddy system from handing out blocks that could overlap tracking metadata for adjacent allocations.
The analytically significant detail is the 'surplus to trim' language in the original code. When a returned block straddles a min_block_size boundary, it creates surplus bytes that represent memory the buddy system believes is split one way but physically lies another. That surplus isn't waste—it creates a mismatch between the allocator's internal state and the physical memory layout. Downstream code expecting clean boundaries could write into regions the allocator thinks are separate. In the worst case, when that misaligned memory is later freed, the free path misidentifies which bin the block belongs in, poisoning the allocator's own metadata. This corruption persists after the allocation is freed and compounds with subsequent allocations that touch the same degraded free-list structures.
The CVSS of 7.8 is optimistic for a kernel-internal allocator bug. The EPSS of 0.00163 correctly reflects low current exploitation probability—but that number reflects the present moment, not the eighteen months this code likely operated with the bug. If the vulnerable path shipped in 5.15 and the fix landed in 6.1, there's a window where GPU subsystems may have accumulated silent fragmentation debt that the fix now changes. The deeper question: what other contiguous fallback paths in the allocator subsystem carry the same implicit alignment guarantee this fix just discovered we were violating?
Verify which GPU drivers or subsystems consume allocations from this buddy allocator path and whether any surface those allocations to userspace through DRM ioctls or render interfaces. Check that your kernel version includes the realignment logic, not just the bail-out-on-misalignment approach from v1. Monitor for allocation failures in GPU driver paths following this patch—error-path cascades triggered by the realignment fallback could manifest as functional degradation where misaligned returns previously masked the problem.