{"cve":"CVE-2026-43150","nvd":{"published":"2026-05-06T12:16:32.690","modified":"2026-10-19T20:18:08.480","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-787","CWE-122"],"references":["https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33","https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a","https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce","https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b","https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2026-43150","score":0.00139,"percentile":0.03246,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}