PatchSiren cyber security CVE debrief

CVE-2026-43347 Linux CVE debrief

CVE-2026-43347 is a Linux kernel arm64 device-tree issue affecting Qualcomm Monaco-based platforms. According to the CVE record, firmware only reserved part of the Gunyah metadata area, leaving the rest available as conventional memory; the kernel could then allocate from hypervisor-owned pages and trigger synchronous external aborts and crashes. The fix reserves the full 512 KiB region and marks it no-map so Linux will not map or allocate from it.

Vendor: Linux
Product: Linux kernel
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-08
Original CVE updated: 2026-05-11
Advisory published: 2026-05-08
Advisory updated: 2026-05-11

Who should care

Linux kernel maintainers, distro security teams, and operators of affected Qualcomm Monaco-based ARM64 systems that rely on EFI memory maps and Gunyah hypervisor metadata.

Technical summary

The CVE description states that the Qualcomm hypervisor reports a 0x91a80000/0x80000 (512 KiB) hypervisor-owned region, but the EFI memory map only reserves 0x91a40000-0x91a87fff. The remainder, 0x91a88000-0x91afffff, is reported as conventional memory, so the allocator may hand out PFNs that belong to hypervisor-owned memory. Accessing those addresses can cause Synchronous External Abort exceptions (ESR=0x96000010) and kernel crashes. The resolution adds a reserved-memory carveout for the full Gunyah metadata region at 0x91a80000 and marks it no-map.

Defensive priority

High for affected Monaco-based deployments, because the issue can produce immediate kernel crashes and system downtime.

Recommended defensive actions

Apply the kernel fix that reserves the full Gunyah metadata region and marks it no-map.
If you maintain downstream kernels, backport the related stable kernel.org fixes cited in the CVE record.
Review Monaco/Qualcomm ARM64 board device trees and EFI memory reservations for any partial overlap with hypervisor-owned memory.
Test affected systems for boot stability after applying the reservation change, especially if they previously showed Synchronous External Abort crashes.
Track vendor and distro advisories for backport availability on any products using this platform.

Evidence notes

All claims are taken from the supplied CVE description and the linked NVD record. The record explicitly says the hypervisor-owned range is 0x91a80000/0x80000, EFI only reserves 0x91a40000-0x91a87fff, and the remaining memory may be misallocated. NVD also lists a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and links three kernel.org stable references.

Sources and references

Verified primary and authoritative sources

CVE-2026-43347 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-43347

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-43347 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43347

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/59bd9088336d2bb7e713dcf4df5cbda86bb3c611

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/85d98669fa7f1d3041d962515e45ee6e392db6f8

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/edde62571f7602d83243ca51729ce42d22ea04d2

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.