CVE-2026-43347: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved.
From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qheehypassignremovememory: 0x91a80000/0x80000 -> ret 0
However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...]
As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses.
Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area.
For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the device tree for Monaco platforms to reserve the full Gunyah metadata region: reserve the memory range at 0x91a80000 of size 0x80000 (512 KiB) and mark it as no-map/hypervisor-owned so Linux neither maps nor allocates from that area (i.e., prevent the 0x91a88000–0x93?fffff Conventional range from being used for hypervisor metadata).
Linux kernel arm64 DTS (qcom monaco) Reserve full Gunyah metadata region at 0x91a80000 (size 0x80000) and mark as no-map / hypervisor-owned = 0x91a80000/0x80000 (512 KiB) reserved and no-map
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43347?
The severity of CVE-2026-43347 is classified as high due to potential kernel crashes and security implications.
How do I fix CVE-2026-43347?
To fix CVE-2026-43347, update the Linux kernel to a version that includes the patch addressing the Gunyah metadata region reserve.
What systems are affected by CVE-2026-43347?
CVE-2026-43347 affects Linux kernel configurations specifically for arm64 architecture on the qcom monaco platform.
What problems does CVE-2026-43347 cause?
CVE-2026-43347 can lead to spurious 'Synchronous External Abort' exceptions and unexpected kernel crashes.
Is CVE-2026-43347 a zero-day vulnerability?
CVE-2026-43347 is not classified as a zero-day vulnerability as it has been publicly disclosed and patched.