HIGH
arm64/dts Gunyah Memory Panic
CVE-2026-43347
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI6.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused by the kernel inadvertently accessing hypervisor-owned memory that is not properly marked as reserved. >From boot log, The Qualcomm hypervisor reports the memory range at 0x91a80000 of size 0x80000 (512 KiB) as hypervisor-owned: qhee_hyp_assign_remove_memory: 0x91a80000/0x80000 -> ret 0 However, the EFI memory map provided by firmware only reserves the subrange 0x91a40000–0x91a87fff (288 KiB). The remaining portion (0x91a88000–0x91afffff) is incorrectly reported as conventional memory (from efi debug): efi: 0x000091a40000-0x000091a87fff [Reserved...] efi: 0x000091a88000-0x0000938fffff [Conventional...] As a result, the allocator may hand out PFNs inside the hypervisor owned region, causing fatal aborts when the kernel accesses those addresses. Add a reserved-memory carveout for the Gunyah hypervisor metadata at 0x91a80000 (512 KiB) and mark it as no-map so Linux does not map or allocate from this area. For the record: Hyp version: gunyah-e78adb36e debug (2025-11-17 05:38:05 UTC) UEFI Ver: 6.0.260122.BOOT.MXF.1.0.c1-00449-KODIAKLA-1
02KernelScan AI Analysis
Risk summary
Monaco-based ARM64 platforms crash with kernel panics when accessing hypervisor-owned memory regions that are incorrectly marked as available. This affects devices running the Qualcomm Monaco SoC with Gunyah hypervisor, causing system instability and denial of service.
Vulnerability analysis
The root cause is a mismatch between the Qualcomm Gunyah hypervisor's memory ownership (0x91a80000-0x91afffff, 512KB) and the EFI firmware's memory map, which only reserves a subset (0x91a40000-0x91a87fff, 288KB). The remaining portion (0x91a88000-0x91afffff) is incorrectly reported as conventional memory, allowing the kernel page allocator to hand out PFNs inside the hypervisor-owned region. When the kernel accesses these addresses—such as during page-fault handling or kernel allocations—it triggers Synchronous External Abort exceptions (ESR=0x96000010) and panics. The fix adds a proper reserved-memory carveout in the device tree with the no-map attribute, preventing allocation from the hypervisor region. Because unprivileged local memory allocations (e.g., mmap and subsequent page-fault processing) can cause the kernel to touch the reserved region, this vulnerability is reachable without privileges and results in a complete denial of service.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.24 | edde62571f76 |
| 6.19 | 6.19.14 | 59bd9088336d |
| mainline | 7.0 | 85d98669fa7f |