Skip to main content

Linux Kernel CVE-2026-43347

| EUVDEUVD-2026-28631 HIGH
2026-05-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-m2rg-757j-v6hh
Qualcomm Denial Of Service Linux
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 11, 2026 - 08:26 vuln.today
CVSS changed
May 11, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
May 08, 2026 - 15:17 EUVD
CVE Published
May 08, 2026 - 14:16 nvd
HIGH 7.5
CVE Published
May 08, 2026 - 14:16 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved.

>From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0

However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000-0x91a87fff (288 KiB). The remaining portion (0x91a88000-0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...]

As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses.

Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area.

For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1

AnalysisAI

Memory corruption in Linux kernel on Qualcomm Monaco-based ARM64 platforms causes kernel crashes through synchronous external aborts when accessing hypervisor-owned memory incorrectly marked as conventional RAM. The firmware's EFI memory map only reserves 288 KiB of a 512 KiB Gunyah hypervisor metadata region (0x91a80000-0x91afffff), leaving 224 KiB exploitable for triggering fatal aborts. Patches available for stable branches 6.18.24, 6.19.14, and 7.0 series. EPSS exploitation probability is very low (0.02%, 4th percentile) with no known active exploitation or public POC, indicating limited real-world threat despite CVSS 7.5 rating.

Technical ContextAI

This vulnerability affects the ARM64 device tree specification for Qualcomm Monaco SoCs running under the Gunyah hypervisor (version gunyah-e78adb36e debug). The hypervisor reserves 512 KiB at physical address 0x91a80000 for metadata, but the UEFI firmware (version 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1) incorrectly reports only 288 KiB (0x91a40000-0x91a87fff) as Reserved in the EFI memory map, marking the remaining 224 KiB (0x91a88000-0x91afffff) as Conventional Memory. This discrepancy between hypervisor memory assignment and firmware memory reporting causes the Linux page allocator to treat hypervisor-protected pages as available RAM. When kernel code accesses these addresses, the ARM64 MMU generates Synchronous External Abort exceptions (ESR_ELx value 0x96000010, indicating a synchronous external abort on memory access). The fix adds an explicit reserved-memory node in the device tree with the no-map attribute to prevent Linux from mapping or allocating from the entire 512 KiB region, overriding the incorrect firmware memory map.

RemediationAI

Update Linux kernel to patched versions: 6.18.24 or later in the 6.18 stable series, 6.19.14 or later in the 6.19 stable series, or kernel 7.0 or later for mainline. Patches are available from kernel.org stable repository at commits 59bd9088336d (6.18), edde62571f76 (6.19), and 85d98669fa7f (7.0) as referenced at https://git.kernel.org/stable/c/ URLs. The fix adds a reserved-memory carveout in the Monaco device tree (arch/arm64/boot/dts/qcom/monaco.dtsi) marking the full 512 KiB Gunyah hypervisor metadata region (0x91a80000-0x91afffff) as no-map. For systems unable to immediately patch, compensating controls are limited: avoid deploying kernel versions in the affected range on Monaco hardware, or work with device manufacturer for UEFI firmware updates that correctly report the full reserved region in the EFI memory map (note: firmware updates carry risk of bricking devices and may not be available for all Monaco platforms). Disabling Gunyah hypervisor features is likely not feasible as it requires bootloader/firmware changes and may break platform functionality. Verification: check dmesg for 'Synchronous External Abort' messages and ESR values around 0x96000010; absence of crashes confirms mitigation.

More in Qualcomm

View all
CVE-2013-2597 HIGH
8.4 Aug 31

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6
CVE-2014-10031 HIGH POC
7.5 Jan 13

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary
CVE-2020-11117 CRITICAL POC
9.8 Sep 08

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arb
CVE-2016-5348 MEDIUM POC
5.9 Oct 10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be
CVE-2014-4322 HIGH POC
7.2 Dec 24

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
CVE-2015-0569 HIGH POC
7.8 May 09

Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka W
CVE-2017-8260 HIGH POC
7.8 Aug 18

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may impr
CVE-2016-3934 HIGH POC
7.8 Oct 10

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016
CVE-2020-11207 HIGH POC
7.8 Nov 12

Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snap
CVE-2020-11206 HIGH POC
7.8 Nov 12

Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' in
CVE-2020-11202 HIGH POC
7.8 Nov 12

Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligne
CVE-2020-11201 HIGH POC
7.8 Nov 12

Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Au

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43347 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy