Linux Kernel CVE-2026-43344

Exploitation requires local authenticated access with at minimum low privileges (CVSS PR:L), confirmed by the AV:L/PR:L vector. The hardware prerequisite is an Intel Sapphire Rapids (SPR) or Emerald Rapids (EMR) server platform where the spr_update_device_location() code path is exercised during PCI enumeration. The PMON-loss bug is specifically triggered when NUMA is disabled in the Linux kernel on a NUMA-capable system (e.g., 'numa=off' boot parameter), causing pcibus_to_node() to return NUMA_NO_NODE. The WARN_ON_ONCE assertion path is triggered when uncore_device_to_die() returns -1 during the nr_node_ids > 8 scan, which occurs when all CPUs associated with a UBOX device are offline. Exploitation is limited to these conditions: local system access, Intel SPR/EMR hardware, and either NUMA-disabled boot configuration or offline CPU scenarios - not applicable to AMD platforms, non-server Intel hardware, or default NUMA-enabled configurations.

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local access with low privilege required - an authenticated local user must be able to interact with the perf subsystem or trigger PCI enumeration paths on affected hardware. The availability impact is rated High, consistent with a potential kernel crash via the reachable assertion or complete loss of hardware PMU functionality. EPSS at 0.02% (5th percentile) indicates very low automated exploitation probability, which aligns with the specialized hardware prerequisite (Intel SPR/EMR server platforms) and local access requirement. There is no CISA KEV listing and no public POC identified. The 'Information Disclosure' tag in EUVD metadata appears inconsistent with the CVSS C:N rating - it likely reflects the consequence of missing PMON visibility rather than data exfiltration, and should not be treated as a confirmed confidentiality impact. Real-world risk is primarily operational: server operators relying on Intel uncore performance counters for workload profiling or capacity planning may experience silent data loss or kernel instability, particularly on SPR/EMR deployments with NUMA disabled.

A local unprivileged user on an Intel Sapphire Rapids server boots the system with NUMA disabled (e.g., 'numa=off' kernel parameter). When the perf subsystem initializes and spr_update_device_location() is called, uncore_device_to_die() returns -1 for all PCI devices, causing all PMON units to be silently skipped. On kernels where the WARN_ON_ONCE(die_id == -1) assertion path is reachable before the fix, the kernel may log a warning or, depending on panic_on_warn configuration, halt - resulting in a denial of service condition requiring physical or remote console access to recover. No public POC exists at time of analysis.