CVE-2026-43347: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
In the Linux kernel, the following vulnerability has been resolved:
arm64: dts: qcom: monaco: Reserve full Gunyah metadata region
We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved.
From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qheehypassignremovememory: 0x91a80000/0x80000 -> ret 0
However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...]
As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses.
Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area.
For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1006.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.14-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 with size 0x80000 (512 KiB), and mark it no-map so Linux does not map or allocate from the region.
Linux arm64 DTS for Qualcomm Monaco Gunyah hypervisor metadata reserved-memory carveout = reg = <0x91a80000 0x80000>; no-map;
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43347?
The severity of CVE-2026-43347 is classified as high due to potential kernel crashes and security implications.
How do I fix CVE-2026-43347?
To fix CVE-2026-43347, update the Linux kernel to a version that includes the patch addressing the Gunyah metadata region reserve.
What systems are affected by CVE-2026-43347?
CVE-2026-43347 affects Linux kernel configurations specifically for arm64 architecture on the qcom monaco platform.
What problems does CVE-2026-43347 cause?
CVE-2026-43347 can lead to spurious 'Synchronous External Abort' exceptions and unexpected kernel crashes.
Is CVE-2026-43347 a zero-day vulnerability?
CVE-2026-43347 is not classified as a zero-day vulnerability as it has been publicly disclosed and patched.