High 7.5Published May 8, 2026

CVE-2026-43347arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

Updated under an hour ago (Oct 26, 2026, 2:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved. >From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0 However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...] As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses. Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area. For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7be190e4bdd2bd1aca84afef06bb755c06a85473 before edde62571f7602d83243ca51729ce42d22ea04d2; from 7be190e4bdd2bd1aca84afef06bb755c06a85473 before 59bd9088336d2bb7e713dcf4df5cbda86bb3c611; from 7be190e4bdd2bd1aca84afef06bb755c06a85473 before 85d98669fa7f1d3041d962515e45ee6e392db6f8	CNA record
linux linux_kernel linux:linux_kernel	from 6.14 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; 7.0; 7.0; and 1 more ranges	NVD

References

https://git.kernel.org/stable/c/edde62571f7602d83243ca51729ce42d22ea04d2patch
https://git.kernel.org/stable/c/59bd9088336d2bb7e713dcf4df5cbda86bb3c611patch
https://git.kernel.org/stable/c/85d98669fa7f1d3041d962515e45ee6e392db6f8patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.