{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43150", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.989Z", "datePublished": "2026-05-06T11:27:32.359Z", "dateUpdated": "2026-08-05T12:26:12.502Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:12.502Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable CMN PMU driver is reached locally through platform-device probing and later local perf/debugfs interfaces, not through network or adjacent protocols. A local user can exercise the registered PMU with perf_event_open on an affected system.\nAC:L - Once the kernel is running on an over-large unsupported CMN configuration that the vulnerable driver accepted, triggering the bad paths is straightforward by opening aggregate CMN PMU events or reading the topology map. There is no attacker-contested race or probabilistic condition in the trigger path.\nPR:L - System-wide CMN PMU use is subject to perf_event_open policy and may require CAP_PERFMON/CAP_SYS_ADMIN on default hardened systems, but reasonable deployments allow unprivileged perf access or expose the 0444 debugfs map. Under the required higher-severity choice, a basic local user is sufficient.\nUI:N - No victim user action is needed after the attacker has local access on the affected system. The attacker can invoke perf_event_open or read the exposed debugfs file directly.\nS:U - The corruption occurs inside the host kernel driver and affects the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary demonstrated.\nC:H - The bug is explicitly about preventing array overflows and memory corruption in kernel data structures used by the PMU driver. Such kernel memory corruption can reasonably be leveraged for high-impact information disclosure.\nI:H - The unsupported topology can drive out-of-bounds writes in fixed-size PMU bookkeeping arrays or debugfs stack data. Kernel out-of-bounds writes are high-integrity impact because they can corrupt control/data structures and may be exploitable for code execution.\nA:H - The same memory corruption can readily crash or hang the kernel even if not weaponized for privilege escalation. A local trigger can therefore cause high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/perf/arm-cmn.c" ], "versions": [ { "version": "28fa550a49e818d6445e787f584759b1bf21d9d4", "lessThan": "7e2c200010aa93fa78201da959b4ac6b9f8fed0b", "status": "affected", "versionType": "git" }, { "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824", "lessThan": "d3e837e11ee9ed08df229272319199003ba00379", "status": "affected", "versionType": "git" }, { "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824", "lessThan": "00d69f21ef2ab00e6156c764d89e2b3539eb2f33", "status": "affected", "versionType": "git" }, { "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824", "lessThan": "08c7eadd8a934a1968e1aeeee8b61b853b99fb3a", "status": "affected", "versionType": "git" }, { "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824", "lessThan": "a251d866f50b6a4c95901fa722025065679c2eca", "status": "affected", "versionType": "git" }, { "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824", "lessThan": "36c0de02575ce59dfd879eb4ef63d53a68bbf9ce", "status": "affected", "versionType": "git" }, { "version": "6.1.63", "lessThan": "6.1.165", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/perf/arm-cmn.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.63", "versionEndExcluding": "6.1.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.128" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b" }, { "url": "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379" }, { "url": "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33" }, { "url": "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a" }, { "url": "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca" }, { "url": "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce" } ], "title": "perf/arm-cmn: Reject unsupported hardware configurations", "x_generator": { "engine": "bippy-1.2.0" } } } }