LiveActive security incident?Get immediate response
CVE Record

CVE-2026-43347: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved. >From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0 However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...] As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses. Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area. For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Affected Linux systems on Qualcomm Monaco hardware may crash because Linux can allocate memory owned by the Gunyah hypervisor. The resulting failure affects availability rather than data confidentiality or integrity. Exposure appears limited to systems using the specified platform and memory layout.

Executive priority

Treat as high priority for confirmed Monaco deployments because crashes can disrupt services or embedded operations. Urgency is lower where this hardware and hypervisor combination is absent. Request platform-specific confirmation before applying broad Linux fleet conclusions.

Technical view

Firmware leaves part of Gunyah’s 512 KiB metadata region reported as conventional memory. Linux may allocate pages from that hypervisor-owned range, causing Synchronous External Abort exceptions and fatal kernel crashes. The resolved change reserves 0x91a80000–0x91afffff and marks it no-map.

Likely exposure

Prioritize ARM64 systems built on Qualcomm Monaco and using Gunyah. The supplied version data is broad and internally unclear, so kernel version alone is insufficient. Systems on other hardware are not identified as affected by these sources.

Exploitation context

The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Although the CVSS vector states network accessibility, the technical description does not establish a remote attack path or attacker-controlled trigger. Confirm exposure through platform and device-tree analysis.

Researcher notes

The core defect is inconsistent ownership reporting: the hypervisor claims 0x91a80000/0x80000, while firmware reserves only an overlapping 288 KiB subrange and exposes the remainder as conventional memory. No confidentiality or integrity impact, reliable attacker trigger, or exploitation evidence is documented. Affected-version metadata requires vendor clarification.

Mitigation direction

  • Apply a vendor-supported kernel or device-tree update containing the cited reserved-memory fix.
  • Confirm the Gunyah metadata region is reserved at 0x91a80000 for 512 KiB and marked no-map.
  • Consult the device or Linux distributor for applicable fixed releases; the supplied version boundaries are unclear.
  • Prioritize remediation on affected systems with observed external aborts or unexplained kernel crashes.

Validation and detection

  • Inventory ARM64 systems using Qualcomm Monaco hardware and the Gunyah hypervisor.
  • Compare deployed kernel and device-tree sources with the three cited stable commits.
  • Verify the full 0x91a80000–0x91afffff region is excluded from Linux mapping and allocation.
  • Review boot and crash logs for ESR 0x96000010 or Synchronous External Abort messages.
  • After updating, perform platform stability testing and confirm the aborts no longer occur.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-43347 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-43347Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7be190e4bdd2bd1aca84afef06bb755c06a85473, 7be190e4bdd2bd1aca84afef06bb755c06a85473, 7be190e4bdd2bd1aca84afef06bb755c06a85473unaffected
LinuxLinux6.14, 0, 6.18.24, 6.19.14, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.