Executive brief
A vulnerability in the Linux kernel on certain Qualcomm-based hardware platforms can cause the system to crash. This occurs because the system incorrectly identifies memory owned by the security hypervisor as available for general use. If the kernel attempts to use this memory, it triggers a fatal system error, leading to a complete service outage on the affected device.
Technical details
A vulnerability exists in the Device Tree Source (DTS) for Qualcomm Monaco-based arm64 platforms where the Gunyah hypervisor metadata region is not fully reserved. While the hypervisor owns a 512 KiB region at 0x91a80000, the EFI memory map provided by firmware only reserves a portion of it, leaving the remainder (0x91a88000–0x91afffff) marked as conventional memory. This allows the Linux kernel memory allocator to assign these pages to other processes or kernel tasks. When the kernel attempts to access this hypervisor-protected memory, it triggers a Synchronous External Abort (ESR=0x96000010), resulting in a kernel panic. The fix involves adding a 'no-map' reserved-memory carveout in the DTS to ensure the kernel does not attempt to manage this region.
Affected products
- Linux Linux Kernel arm64 qcom monaco platforms
Timeline
- 2026-03-02: other: Initial patch authored
- 2026-05-08: advisory: CVE published by kernel.org