CVE-2026-43150 (GCVE-0-2026-43150)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:27 – Updated: 2026-10-19 19:16
VLAI
Title
perf/arm-cmn: Reject unsupported hardware configurations
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/arm-cmn: Reject unsupported hardware configurations So far we've been fairly lax about accepting both unknown CMN models (at least with a warning), and unknown revisions of those which we do know, as although things do frequently change between releases, typically enough remains the same to be somewhat useful for at least some basic bringup checks. However, we also make assumptions of the maximum supported sizes and numbers of things in various places, and there's no guarantee that something new might not be bigger and lead to nasty array overflows. Make sure we only try to run on things that actually match our assumptions and so will not risk memory corruption. We have at least always failed on completely unknown node types, so update that error message for clarity and consistency too.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:15 UTC
CWE
  • CWE-122 - Heap-based Buffer Overflow
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7033 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 28fa550a49e818d6445e787f584759b1bf21d9d4 , < 7e2c200010aa93fa78201da959b4ac6b9f8fed0b (git)
Affected: 7819e05a0dceac20c5ff78ec9b252faf3b76b824 , < d3e837e11ee9ed08df229272319199003ba00379 (git)
Affected: 7819e05a0dceac20c5ff78ec9b252faf3b76b824 , < 00d69f21ef2ab00e6156c764d89e2b3539eb2f33 (git)
Affected: 7819e05a0dceac20c5ff78ec9b252faf3b76b824 , < 08c7eadd8a934a1968e1aeeee8b61b853b99fb3a (git)
Affected: 7819e05a0dceac20c5ff78ec9b252faf3b76b824 , < a251d866f50b6a4c95901fa722025065679c2eca (git)
Affected: 7819e05a0dceac20c5ff78ec9b252faf3b76b824 , < 36c0de02575ce59dfd879eb4ef63d53a68bbf9ce (git)
Affected: 6.1.63 , < 6.1.165 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:15:10.201472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "CWE-122 Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:16:22.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm-cmn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e2c200010aa93fa78201da959b4ac6b9f8fed0b",
              "status": "affected",
              "version": "28fa550a49e818d6445e787f584759b1bf21d9d4",
              "versionType": "git"
            },
            {
              "lessThan": "d3e837e11ee9ed08df229272319199003ba00379",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "00d69f21ef2ab00e6156c764d89e2b3539eb2f33",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "08c7eadd8a934a1968e1aeeee8b61b853b99fb3a",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "a251d866f50b6a4c95901fa722025065679c2eca",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "36c0de02575ce59dfd879eb4ef63d53a68bbf9ce",
              "status": "affected",
              "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.63",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/perf/arm-cmn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we\u0027ve been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere\u0027s no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable CMN PMU driver is reached locally through platform-device probing and later local perf/debugfs interfaces, not through network or adjacent protocols. A local user can exercise the registered PMU with perf_event_open on an affected system.\nAC:L - Once the kernel is running on an over-large unsupported CMN configuration that the vulnerable driver accepted, triggering the bad paths is straightforward by opening aggregate CMN PMU events or reading the topology map. There is no attacker-contested race or probabilistic condition in the trigger path.\nPR:L - System-wide CMN PMU use is subject to perf_event_open policy and may require CAP_PERFMON/CAP_SYS_ADMIN on default hardened systems, but reasonable deployments allow unprivileged perf access or expose the 0444 debugfs map. Under the required higher-severity choice, a basic local user is sufficient.\nUI:N - No victim user action is needed after the attacker has local access on the affected system. The attacker can invoke perf_event_open or read the exposed debugfs file directly.\nS:U - The corruption occurs inside the host kernel driver and affects the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary demonstrated.\nC:H - The bug is explicitly about preventing array overflows and memory corruption in kernel data structures used by the PMU driver. Such kernel memory corruption can reasonably be leveraged for high-impact information disclosure.\nI:H - The unsupported topology can drive out-of-bounds writes in fixed-size PMU bookkeeping arrays or debugfs stack data. Kernel out-of-bounds writes are high-integrity impact because they can corrupt control/data structures and may be exploitable for code execution.\nA:H - The same memory corruption can readily crash or hang the kernel even if not weaponized for privilege escalation. A local trigger can therefore cause high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:12.502Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"
        },
        {
          "url": "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"
        }
      ],
      "title": "perf/arm-cmn: Reject unsupported hardware configurations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43150",
    "datePublished": "2026-05-06T11:27:32.359Z",
    "dateReserved": "2026-05-01T14:12:55.989Z",
    "dateUpdated": "2026-10-19T19:16:22.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43150",
      "date": "2026-10-30",
      "epss": "0.00139",
      "percentile": "0.03261"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/perf/arm-cmn.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7e2c200010aa93fa78201da959b4ac6b9f8fed0b",
                    "status": "affected",
                    "version": "28fa550a49e818d6445e787f584759b1bf21d9d4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3e837e11ee9ed08df229272319199003ba00379",
                    "status": "affected",
                    "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "00d69f21ef2ab00e6156c764d89e2b3539eb2f33",
                    "status": "affected",
                    "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08c7eadd8a934a1968e1aeeee8b61b853b99fb3a",
                    "status": "affected",
                    "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a251d866f50b6a4c95901fa722025065679c2eca",
                    "status": "affected",
                    "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36c0de02575ce59dfd879eb4ef63d53a68bbf9ce",
                    "status": "affected",
                    "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.165",
                    "status": "affected",
                    "version": "6.1.63",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/perf/arm-cmn.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.5"
                  },
                  {
                    "lessThan": "6.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AD1E11C2-5A82-49FA-B142-61E121FD4529",
                    "versionEndExcluding": "6.1.165",
                    "versionStartIncluding": "6.1.63",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A502C6C1-0CFB-4C9B-8A24-C76507206FA7",
                    "versionEndExcluding": "6.6.128",
                    "versionStartIncluding": "6.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we\u0027ve been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere\u0027s no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."
          }
        ],
        "id": "CVE-2026-43150",
        "lastModified": "2026-10-19T20:18:08.480",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-43150",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:15:10.201472Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-06T12:16:32.690",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-122"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-29T09:29:40+00:00",
      "cve": "CVE-2026-43150",
      "id": "CVE-2026-43150",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf/arm-cmn: Reject unsupported hardware configurations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43150.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-43150",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T15:15:10.201472Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-122",
                    "description": "CWE-122 Heap-based Buffer Overflow",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T15:15:10.783Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/perf/arm-cmn.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "7e2c200010aa93fa78201da959b4ac6b9f8fed0b",
                  "status": "affected",
                  "version": "28fa550a49e818d6445e787f584759b1bf21d9d4",
                  "versionType": "git"
                },
                {
                  "lessThan": "d3e837e11ee9ed08df229272319199003ba00379",
                  "status": "affected",
                  "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                  "versionType": "git"
                },
                {
                  "lessThan": "00d69f21ef2ab00e6156c764d89e2b3539eb2f33",
                  "status": "affected",
                  "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                  "versionType": "git"
                },
                {
                  "lessThan": "08c7eadd8a934a1968e1aeeee8b61b853b99fb3a",
                  "status": "affected",
                  "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                  "versionType": "git"
                },
                {
                  "lessThan": "a251d866f50b6a4c95901fa722025065679c2eca",
                  "status": "affected",
                  "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                  "versionType": "git"
                },
                {
                  "lessThan": "36c0de02575ce59dfd879eb4ef63d53a68bbf9ce",
                  "status": "affected",
                  "version": "7819e05a0dceac20c5ff78ec9b252faf3b76b824",
                  "versionType": "git"
                },
                {
                  "lessThan": "6.1.165",
                  "status": "affected",
                  "version": "6.1.63",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/perf/arm-cmn.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.5"
                },
                {
                  "lessThan": "6.5",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.165",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.128",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.75",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.18.*",
                  "status": "unaffected",
                  "version": "6.18.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.19.*",
                  "status": "unaffected",
                  "version": "6.19.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "7.0",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.165",
                      "versionStartIncluding": "6.1.63",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.128",
                      "versionStartIncluding": "6.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.75",
                      "versionStartIncluding": "6.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.18.16",
                      "versionStartIncluding": "6.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.19.6",
                      "versionStartIncluding": "6.5",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "7.0",
                      "versionStartIncluding": "6.5",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we\u0027ve been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere\u0027s no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable CMN PMU driver is reached locally through platform-device probing and later local perf/debugfs interfaces, not through network or adjacent protocols. A local user can exercise the registered PMU with perf_event_open on an affected system.\nAC:L - Once the kernel is running on an over-large unsupported CMN configuration that the vulnerable driver accepted, triggering the bad paths is straightforward by opening aggregate CMN PMU events or reading the topology map. There is no attacker-contested race or probabilistic condition in the trigger path.\nPR:L - System-wide CMN PMU use is subject to perf_event_open policy and may require CAP_PERFMON/CAP_SYS_ADMIN on default hardened systems, but reasonable deployments allow unprivileged perf access or expose the 0444 debugfs map. Under the required higher-severity choice, a basic local user is sufficient.\nUI:N - No victim user action is needed after the attacker has local access on the affected system. The attacker can invoke perf_event_open or read the exposed debugfs file directly.\nS:U - The corruption occurs inside the host kernel driver and affects the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary demonstrated.\nC:H - The bug is explicitly about preventing array overflows and memory corruption in kernel data structures used by the PMU driver. Such kernel memory corruption can reasonably be leveraged for high-impact information disclosure.\nI:H - The unsupported topology can drive out-of-bounds writes in fixed-size PMU bookkeeping arrays or debugfs stack data. Kernel out-of-bounds writes are high-integrity impact because they can corrupt control/data structures and may be exploitable for code execution.\nA:H - The same memory corruption can readily crash or hang the kernel even if not weaponized for privilege escalation. A local trigger can therefore cause high availability impact."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:26:12.502Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"
            },
            {
              "url": "https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"
            },
            {
              "url": "https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"
            },
            {
              "url": "https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"
            },
            {
              "url": "https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"
            },
            {
              "url": "https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"
            }
          ],
          "title": "perf/arm-cmn: Reject unsupported hardware configurations",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2026-43150",
        "datePublished": "2026-05-06T11:27:32.359Z",
        "dateReserved": "2026-05-01T14:12:55.989Z",
        "dateUpdated": "2026-10-19T19:16:22.180Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.