CVE-2026-43347

The vulnerability stems from an incomplete memory reservation in the ARM64 device tree for Qualcomm Monaco. The hypervisor (Gunyah) reports a memory region at 0x91a80000 (512 KiB) as hypervisor-owned, but the EFI memory map only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remainder (0x91a88000–0x91afffff) is incorrectly marked as conventional memory, allowing the kernel to allocate and access pages that belong to the hypervisor [1].

Exploitation occurs when the kernel inadvertently accesses these improperly reserved addresses, leading to a Synchronous External Abort (ESR=0x96000010). This can be triggered by any memory allocation or access that touches the disputed region, potentially through normal system operations or deliberate actions by an attacker. No special privileges are required beyond the ability to influence memory allocation on the target system.

The primary impact is a denial of service, as the system crashes due to the external abort. The CVSS v3 score of 7.5 (High) reflects the high availability impact, as the vulnerability can be reliably exploited to cause a system panic.

The fix, applied in the Linux kernel, adds a reserved-memory carveout for the full 512 KiB Gunyah metadata region at 0x91a80000 with the no-map flag, preventing the kernel from mapping or allocating from this area. Users are advised to update to a patched kernel version from the stable branch [1].