From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CC5BB396D15 for ; Fri, 8 May 2026 13:39:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778247583; cv=none; b=ZBeyKcL0dVPpVdZlQoc9tIQJJspy03s02lSIsIQIhX/N4z/CXzkSNmwctXaEeoIj+ZyhLMQQQmAmeDTGe9IdXsiwY2tVs0m3NRqILRrpRFlGTserbY72RX7KlQqpmC4iZGJ3ZDClwNNKogQLjmgDi3Suu/YiRcqvp+sy8DrRKks= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778247583; c=relaxed/simple; bh=LWH6w5upcwjE7tYWODixHNHsigRAbdECZjQt/2bEWIs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=flPLoFsQ9cQTK7nI9iO7rxdBvGO9PSVrmsnuDRwvdRW+j+oZVVn64ZXWlWH1oOmiJNZliheQNUxSEArhnVNA12BjhozvsMTnlJcRqIGgX9asWQWmE4UC3AFDgUribf0RJ0rgnfX3zLjk8o2K+b3CvZppYAXSRh9LJYddWeowGbA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=rk/Io/5b; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="rk/Io/5b" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3CA71C2BCB0; Fri, 8 May 2026 13:39:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778247583; bh=LWH6w5upcwjE7tYWODixHNHsigRAbdECZjQt/2bEWIs=; h=From:To:Cc:Subject:Date:Reply-To:From; b=rk/Io/5bYFTPurpdLQZ/OIxN7MBxBkFNm07RG3hrPd9mDVYKtgtmiC/QH3gvQAH5N uOQs1dkR19NNDnXf41MoJaV6+2B3yv0hfpTkyVLKkeKLA7l/SdYS9gBSqXSqIoDSFp KwXLkJEMkvxjIXgvNuXu+XhzejwGuGkb9L3wgpyo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43344: perf/x86/intel/uncore: Fix die ID init and look up bugs Date: Fri, 8 May 2026 15:39:35 +0200 Message-ID: <2026050836-CVE-2026-43344-8a41@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3039; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=oDv1D7oWqQz04PuQ3jCWo3PwsNV9WFcSCgFtSwPXFMc=; b=owGbwMvMwCRo6H6F97bub03G02pJDJl/n8/w1z3QIdSRdthx96/+H3efvn33cG5B0mW/Q1k3q leuDd69pyOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmolHDML9id7aGw0HRZVM7 q3Mzko5kOO1iWMcw3/P9SUYrmWkH+NyFV6x+vvBwdJqpNwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error. Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree. Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init(). Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled. The Linux kernel CVE team has assigned CVE-2026-43344 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit 9a7832ce3d920426a36cdd78eda4b3568d4d09e3 and fixed in 6.19.14 with commit 6a5dc3ee97581da2907fc7acd62853f07184de67 Issue introduced in 5.12 with commit 9a7832ce3d920426a36cdd78eda4b3568d4d09e3 and fixed in 7.0 with commit a16d1ec4dd0cdcf689f324adde6067083bce9099 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43344 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/events/intel/uncore.c arch/x86/events/intel/uncore_snbep.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6a5dc3ee97581da2907fc7acd62853f07184de67 https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099