Executive brief
A vulnerability in the Linux kernel's networking component could allow a malicious user to crash or slow down a system by exhausting its memory. The issue exists in the Qualcomm IPC Router (QRTR) protocol, where the system fails to limit how many virtual 'servers' a single user can register. By flooding the system with registration requests, an attacker can consume all available memory, leading to a denial-of-service.
Technical details
A memory exhaustion vulnerability exists in the Linux kernel's QRTR nameservice (net/qrtr/ns.c). The `server_add` function fails to perform bounds checking on the number of servers registered per node. An attacker can exploit this by flooding the system with `NEW_SERVER` messages, causing the kernel to allocate an unbounded number of `qrtr_server` structures and eventually exhaust system memory. The fix introduces a limit of 256 server registrations per node and implements rate-limiting for associated error messages in `qrtr_ns_worker` to prevent log flooding.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-05-03: patched: Initial patch authored by Manivannan Sadhasivam
- 2026-05-19: disclosed: CVE-2026-43491 published
References
- https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d
- https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b
- https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c
- https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955
- https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7