CVE-2026-43150CWE-122CWE-787

CVE-2026-43150

High · published May 6, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

perf/arm-cmn: Reject unsupported hardware configurations

So far we've been fairly lax about accepting both unknown CMN models

(at least with a warning), and unknown revisions of those which we

do know, as although things do frequently change between releases,

typically enough remains the same to be somewhat useful for at least

some basic bringup checks. However, we also make assumptions of the

maximum supported sizes and numbers of things in various places, and

there's no guarantee that something new might not be bigger and lead

to nasty array overflows. Make sure we only try to run on things that

actually match our assumptions and so will not risk memory corruption.

We have at least always failed on completely unknown node types, so

update that error message for clarity and consistency too.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2026-05-06T16:16Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.1.63, < 6.1.1656.1.165
linux/linux_kernel≥ 6.5, < 6.6.1286.6.128
linux/linux_kernel≥ 6.7, < 6.12.756.12.75
linux/linux_kernel≥ 6.13, < 6.18.166.18.16
linux/linux_kernel≥ 6.19, < 6.19.66.19.6
References (6)
EPSS history
Timeline
  • 06 MAY 11:27Z
    perf/arm-cmn: Reject unsupported hardware configurations
    cvelistv5