PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43347 Git CVE debrief

CVE-2026-43347 is a Linux kernel arm64 device-tree issue affecting Qualcomm Monaco-based platforms. According to the CVE record, firmware only reserved part of the Gunyah metadata area, leaving the rest available as conventional memory; the kernel could then allocate from hypervisor-owned pages and trigger synchronous external aborts and crashes. The fix reserves the full 512 KiB region and marks it no-map so Linux will not map or allocate from it.

Vendor
Git
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

Linux kernel maintainers, distro security teams, and operators of affected Qualcomm Monaco-based ARM64 systems that rely on EFI memory maps and Gunyah hypervisor metadata.

Technical summary

The CVE description states that the Qualcomm hypervisor reports a 0x91a80000/0x80000 (512 KiB) hypervisor-owned region, but the EFI memory map only reserves 0x91a40000-0x91a87fff. The remainder, 0x91a88000-0x91afffff, is reported as conventional memory, so the allocator may hand out PFNs that belong to hypervisor-owned memory. Accessing those addresses can cause Synchronous External Abort exceptions (ESR=0x96000010) and kernel crashes. The resolution adds a reserved-memory carveout for the full Gunyah metadata region at 0x91a80000 and marks it no-map.

Defensive priority

High for affected Monaco-based deployments, because the issue can produce immediate kernel crashes and system downtime.

Recommended defensive actions

  • Apply the kernel fix that reserves the full Gunyah metadata region and marks it no-map.
  • If you maintain downstream kernels, backport the related stable kernel.org fixes cited in the CVE record.
  • Review Monaco/Qualcomm ARM64 board device trees and EFI memory reservations for any partial overlap with hypervisor-owned memory.
  • Test affected systems for boot stability after applying the reservation change, especially if they previously showed Synchronous External Abort crashes.
  • Track vendor and distro advisories for backport availability on any products using this platform.

Evidence notes

All claims are taken from the supplied CVE description and the linked NVD record. The record explicitly says the hypervisor-owned range is 0x91a80000/0x80000, EFI only reserves 0x91a40000-0x91a87fff, and the remaining memory may be misallocated. NVD also lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and links three kernel.org stable references.

Official resources

CVE record published at 2026-05-08T14:16:44.777Z and modified at 2026-05-11T08:16:10.680Z. This debrief uses those CVE timestamps and the linked official records as the timing context.