CVE-2026-43347

arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

High · published May 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

arm64: dts: qcom: monaco: Reserve full Gunyah metadata region

We observe spurious "Synchronous External Abort" exceptions

(ESR=0x96000010) and kernel crashes on Monaco-based platforms.

These faults are caused by the kernel inadvertently accessing

hypervisor-owned memory that is not properly marked as reserved.

>From boot log, The Qualcomm hypervisor reports the memory range

at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned:

qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0

However, the EFI memory map provided by firmware only reserves the

subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion

(0x91a88000–0x91afffff) is incorrectly reported as conventional

memory (from efi debug):

efi: 0x000091a40000-0x000091a87fff [Reserved...]

efi: 0x000091a88000-0x0000938fffff [Conventional...]

As a result, the allocator may hand out PFNs inside the hypervisor

owned region, causing fatal aborts when the kernel accesses those

addresses.

Add a reserved-memory carveout for the Gunyah hypervisor metadata

at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not

map or allocate from this area.

For the record:

Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC)

UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00609 · 48.5th percentile
Published
2026-05-08T13:39Z
EPSS history
Timeline
  • 08 MAY 13:39Z
    arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
    cvelistv5