CVE-2026-43150 (GCVE-0-2026-43150)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which we do know, as although things do frequently change between releases, typically enough remains the same to be somewhat useful for at least some basic bringup checks. However, we also make assumptions of the maximum supported sizes and numbers of things in various places, and there's no guarantee that something new might not be bigger and lead to nasty array overflows. Make sure we only try to run on things that actually match our assumptions and so will not risk memory corruption. We have at least always failed on completely unknown node types, so update that error message for clarity and consistency too.
References
Impacted products
Vendor Product Version
Linux Linux Version: 28fa550a49e818d6445e787f584759b1bf21d9d4
Version: 7819e05a0dceac20c5ff78ec9b252faf3b76b824
Version: 7819e05a0dceac20c5ff78ec9b252faf3b76b824
Version: 7819e05a0dceac20c5ff78ec9b252faf3b76b824
Version: 7819e05a0dceac20c5ff78ec9b252faf3b76b824
Version: 7819e05a0dceac20c5ff78ec9b252faf3b76b824
Version: 6.1.63   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm-cmn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e2c200010aa93fa78201da959b4ac6b9f8fed0b",
              "status": "affected",
              "version": "28fa550a49e818d6445e787f584759b1bf21d9d4",
              "versionType": "git"
            },
            {
              "lessThan": "d3e837e11ee9ed08df229272319199003ba00379",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "00d69f21ef2ab00e6156c764d89e2b3539eb2f33",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "08c7eadd8a934a1968e1aeeee8b61b853b99fb3a",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "a251d866f50b6a4c95901fa722025065679c2eca",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "36c0de02575ce59dfd879eb4ef63d53a68bbf9ce",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.63",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm-cmn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we\u0027ve been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere\u0027s no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable CMN PMU driver is reached locally through platform-device probing and later local perf/debugfs interfaces, not through network or adjacent protocols. A local user can exercise the registered PMU with perf_event_open on an affected system.\nAC:L - Once the kernel is running on an over-large unsupported CMN configuration that the vulnerable driver accepted, triggering the bad paths is straightforward by opening aggregate CMN PMU events or reading the topology map. There is no attacker-contested race or probabilistic condition in the trigger path.\nPR:L - System-wide CMN PMU use is subject to perf_event_open policy and may require CAP_PERFMON/CAP_SYS_ADMIN on default hardened systems, but reasonable deployments allow unprivileged perf access or expose the 0444 debugfs map. Under the required higher-severity choice, a basic local user is sufficient.\nUI:N - No victim user action is needed after the attacker has local access on the affected system. The attacker can invoke perf_event_open or read the exposed debugfs file directly.\nS:U - The corruption occurs inside the host kernel driver and affects the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary demonstrated.\nC:H - The bug is explicitly about preventing array overflows and memory corruption in kernel data structures used by the PMU driver. Such kernel memory corruption can reasonably be leveraged for high-impact information disclosure.\nI:H - The unsupported topology can drive out-of-bounds writes in fixed-size PMU bookkeeping arrays or debugfs stack data. Kernel out-of-bounds writes are high-integrity impact because they can corrupt control/data structures and may be exploitable for code execution.\nA:H - The same memory corruption can readily crash or hang the kernel even if not weaponized for privilege escalation. A local trigger can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:12.502Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"
        }
      ],
      "title": "perf/arm-cmn: Reject unsupported hardware configurations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43150",
    "datePublished": "2026-05-06T11:27:32.359Z",
    "dateReserved": "2026-05-01T14:12:55.989Z",
    "dateUpdated": "2026-08-05T12:26:12.502Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.