Skip to main content

Linux Kernel EUVDEUVD-2026-27822

| CVE-2026-43261 MEDIUM
2026-05-06 Linux GHSA-q2m9-5gr9-rjw9
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.6 MEDIUM

Local low-privilege access required; AC:H reflects BHB timing precision needed; S:C because speculative execution crosses privilege boundary; C:H is the actual impact (information leakage), not A:H as the provided vector incorrectly states.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:53 vuln.today
CVSS changed
May 08, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

arm64: Add support for TSV110 Spectre-BHB mitigation

The TSV110 processor is vulnerable to the Spectre-BHB (Branch History Buffer) attack, which can be exploited to leak information through branch prediction side channels. This commit adds the MIDR of TSV110 to the list for software mitigation.

AnalysisAI

Spectre-BHB (Branch History Buffer) software mitigation was absent in the Linux kernel arm64 subsystem for systems running the HiSilicon TSV110 processor, leaving those systems exposed to branch prediction side-channel attacks capable of leaking sensitive kernel memory contents across privilege boundaries. The root cause was the kernel lacking the TSV110 MIDR (Main ID Register) entry in its processor-specific mitigation table, meaning the software workaround was never applied on that hardware. No public exploit has been identified at time of analysis, and EPSS probability sits at a low 0.02% (7th percentile), though the real-world confidentiality risk on Huawei/HiSilicon arm64 deployments is meaningful given the class of attack.

Technical ContextAI

Spectre-BHB is a class of transient execution side-channel attack that manipulates the Branch History Buffer (BHB) shared between privilege levels on modern processors, allowing an unprivileged attacker to influence speculative execution paths in higher-privilege contexts and subsequently exfiltrate data via cache timing (Flush+Reload or similar). The TSV110 is HiSilicon's Kirin 980 microarchitecture, used in Huawei servers and mobile SoCs targeting the arm64 (AArch64) architecture. The Linux kernel maintains a per-CPU MIDR (Main ID Register) list to determine which software mitigations to apply at boot; without the TSV110 MIDR entry, the kernel skips the Spectre-BHB software sequence on that processor entirely. The CPE identifies the affected product as cpe:2.3:a:linux:linux (all versions up to the stable branch fix commits). No CWE was assigned, but this aligns with CWE-203 (Observable Discrepancy) and CWE-1342 (Information Exposure through Microarchitectural State after Transient Execution).

RemediationAI

The primary fix is upgrading to a patched Linux kernel stable release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0, as confirmed by EUVD and kernel.org stable commits. Distribution-specific packages for Ubuntu are addressed in USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1), and Red Hat and SUSE advisories should be consulted for RHEL and SLES arm64 deployments. If immediate patching is not feasible, compensating controls include restricting local code execution on affected TSV110 systems via mandatory access control frameworks (SELinux, AppArmor) to limit which processes can run untrusted code - note this reduces attack surface but does not eliminate the underlying microarchitectural exposure. Disabling untrusted multi-tenant workloads on bare-metal TSV110 hardware until patching is complete is the most effective interim mitigation. Systems not running on HiSilicon TSV110 processors are not affected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27822 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy