CVE-2026-43347

{"id": "CVE-2026-43347", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7be190e4bdd2bd1aca84afef06bb755c06a85473", "lessThan": "edde62571f7602d83243ca51729ce42d22ea04d2", "versionType": "git"}, {"status": "affected", "version": "7be190e4bdd2bd1aca84afef06bb755c06a85473", "lessThan": "59bd9088336d2bb7e713dcf4df5cbda86bb3c611", "versionType": "git"}, {"status": "affected", "version": "7be190e4bdd2bd1aca84afef06bb755c06a85473", "lessThan": "85d98669fa7f1d3041d962515e45ee6e392db6f8", "versionType": "git"}], "programFiles": ["arch/arm64/boot/dts/qcom/monaco.dtsi"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/boot/dts/qcom/monaco.dtsi"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:44.777", "references": [{"url": "https://git.kernel.org/stable/c/59bd9088336d2bb7e713dcf4df5cbda86bb3c611", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/85d98669fa7f1d3041d962515e45ee6e392db6f8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/edde62571f7602d83243ca51729ce42d22ea04d2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: dts: qcom: monaco: Reserve full Gunyah metadata region\n\nWe observe spurious \"Synchronous External Abort\" exceptions\n(ESR=0x96000010) and kernel crashes on Monaco-based platforms.\nThese faults are caused by the kernel inadvertently accessing\nhypervisor-owned memory that is not properly marked as reserved.\n\n>From boot log, The Qualcomm hypervisor reports the memory range\nat 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned:\nqhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0\n\nHowever, the EFI memory map provided by firmware only reserves the\nsubrange 0x91a40000\u20130x91a87fff (288 KiB). The remaining portion\n(0x91a88000\u20130x91afffff) is incorrectly reported as conventional\nmemory (from efi debug):\nefi: 0x000091a40000-0x000091a87fff [Reserved...]\nefi: 0x000091a88000-0x0000938fffff [Conventional...]\n\nAs a result, the allocator may hand out PFNs inside the hypervisor\nowned region, causing fatal aborts when the kernel accesses those\naddresses.\n\nAdd a reserved-memory carveout for the Gunyah hypervisor metadata\nat 0x91a80000 (512 KiB) and mark it as no-map so Linux does not\nmap or allocate from this area.\n\nFor the record:\nHyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC)\nUEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm64: dts: qcom: monaco: Reservar la regi\u00f3n completa de metadatos de Gunyah\n\nObservamos excepciones espurias de \u2019Synchronous External Abort\u2019 (ESR=0x 96000010) y fallos del kernel en plataformas basadas en Monaco. Estas fallas son causadas por el kernel que accede inadvertidamente a memoria propiedad del hipervisor que no est\u00e1 correctamente marcada como reservada.\n\nDel registro de arranque, el hipervisor de Qualcomm informa el rango de memoria en 0x 91a80000 de tama\u00f1o 0x 80000 (512 KiB) como propiedad del hipervisor:\nqhee_hyp_assign_remove_memory: 0x 91a80000/0x 80000 -> ret 0\n\nSin embargo, el mapa de memoria EFI proporcionado por el firmware solo reserva el subrango 0x 91a40000-0x 91a87fff (288 KiB). La porci\u00f3n restante (0x 91a88000-0x 91afffff) se informa incorrectamente como memoria convencional (de la depuraci\u00f3n de efi):\nefi: 0x 000091a40000-0x 000091a87fff [Reservado...]\nefi: 0x 000091a88000-0x 0000938fffff [Convencional...]\n\nComo resultado, el asignador puede entregar PFNs dentro de la regi\u00f3n propiedad del hipervisor, causando abortos fatales cuando el kernel accede a esas direcciones.\n\nA\u00f1adir una reserva de memoria para los metadatos del hipervisor Gunyah en 0x 91a80000 (512 KiB) y marcarla como no-map para que Linux no mapee ni asigne desde esta \u00e1rea.\n\nPara que conste:\nVersi\u00f3n de Hyp: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC)\nVersi\u00f3n de UEFI: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1"}], "lastModified": "2026-11-11T20:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F789B310-F070-49AF-AD11-2773C8D3A364", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}