CVE-2026-43150: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43150 Overview

CVE-2026-43150 is a Linux kernel vulnerability in the perf/arm-cmn driver, which provides performance monitoring support for Arm Coherent Mesh Network (CMN) interconnects. The driver previously accepted unknown CMN models and unrecognized revisions of known models, issuing only a warning. Because the driver also assumes maximum supported sizes and counts for various hardware structures, newer or unknown configurations could exceed those limits and trigger array overflows. The fix rejects unsupported hardware configurations outright to avoid the risk of memory corruption.

Critical Impact
Loading the arm-cmn driver on systems with unknown or newer CMN hardware revisions could lead to out-of-bounds array writes and kernel memory corruption.

Affected Products

Linux kernel versions including the perf/arm-cmn driver prior to the fix
Arm-based systems using Coherent Mesh Network (CMN) interconnect hardware
Distributions shipping affected stable kernel branches referenced in the upstream commits

Discovery Timeline

2026-05-06 - CVE-2026-43150 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43150

Vulnerability Analysis

The perf/arm-cmn driver implements performance monitoring unit (PMU) support for Arm CMN interconnects in the Linux kernel. The driver internally relies on hardcoded assumptions about the maximum number of nodes, ports, and other topology elements that can exist in a CMN mesh. These assumptions inform the static sizing of internal arrays and bookkeeping structures.

Before this fix, the driver tolerated unknown CMN model identifiers and unrecognized revisions of known models, logging a warning and continuing initialization. The rationale was practical: revisions usually preserve enough register layout for basic bringup. However, this leniency created a latent issue. A future or unknown CMN variant could expose more nodes or ports than the driver's compiled-in maximums, causing iteration over discovered hardware to write past the bounds of fixed-size arrays.

The corrected behavior tightens hardware probing so the driver only initializes on models and revisions that match its sizing assumptions. The patch also clarifies the existing error message emitted for completely unknown node types.

Root Cause

The root cause is insufficient input validation of hardware-reported topology against the driver's compile-time array bounds [CWE-787 class behavior]. The driver trusted that unknown CMN variants would conform to the size limits of known ones, an assumption not guaranteed by Arm's hardware roadmap.

Attack Vector

Exploitation requires hardware that misreports or legitimately exceeds the driver's expected topology limits. This is not a remote network-reachable vulnerability. The realistic risk surface is kernel memory corruption during driver probe on affected Arm platforms running unsupported CMN silicon revisions, which could destabilize the system or, in unusual conditions, be leveraged for local privilege escalation.

See the upstream fixes referenced in Kernel Git Commit 00d69f21 and Kernel Git Commit a251d866 for the implementation details of the validation logic.

Detection Methods for CVE-2026-43150

Indicators of Compromise

Kernel log warnings from the arm-cmn driver referencing unknown CMN model IDs or unknown revisions during boot.
Kernel oops, panic, or stack trace output naming functions in drivers/perf/arm-cmn.c shortly after PMU initialization.
Unexpected memory corruption symptoms (random crashes, scheduler errors) on Arm platforms after enabling CMN performance counters.

Detection Strategies

Inventory Arm-based systems and identify those using CMN interconnects with kernel versions predating the patch commits.
Parse dmesg output across the fleet for arm-cmn warning strings indicating unrecognized hardware.
Compare deployed kernel versions against the fixed stable branches listed in the kernel.org commits.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on arm-cmn warnings or driver-level oops messages.
Monitor for unexpected reboots and kernel panics on Arm server fleets that load the CMN PMU driver.
Track kernel package versions through configuration management to confirm patched builds are deployed.

How to Mitigate CVE-2026-43150

Immediate Actions Required

Apply the patched Linux kernel containing the perf/arm-cmn validation fix to all affected Arm systems.
Reboot updated systems to ensure the new driver logic is in effect before re-enabling CMN performance monitoring workloads.
Audit kernel boot logs after patching to confirm the driver no longer warns about unknown CMN configurations.

Patch Information

The fix is distributed across multiple stable kernel branches via the following upstream commits: Kernel Git Commit 00d69f21, Kernel Git Commit 08c7eadd, Kernel Git Commit 36c0de02, Kernel Git Commit 7e2c2000, Kernel Git Commit a251d866, and Kernel Git Commit d3e837e1. Pull the corresponding distribution kernel update or rebuild from the patched stable branch.

Workarounds

Disable the arm-cmn driver by building the kernel without CONFIG_ARM_CMN or by blacklisting the module on systems that do not require CMN performance counters.
Restrict use of the CMN PMU on hardware revisions known to match the driver's supported models until patched kernels are deployed.
Limit local user access to performance monitoring interfaces such as perf_event_open via kernel.perf_event_paranoid sysctl tuning to reduce local exposure.

bash

# Configuration example: blacklist the arm-cmn module and tighten perf access
echo 'blacklist arm_cmn' | sudo tee /etc/modprobe.d/blacklist-arm-cmn.conf
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/99-perf-paranoid.conf