CVE-2026-43041: net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: replace qrtrtxflow radixtree with xarray to fix memory leak
radixtreecreate() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radixtreeforeachslot() only visits slots containing leaf values.
The radixtree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtrtxflow from radixtree to xarray instead of fixing the radixtree itself [1]. xarray properly handles cleanup of internal nodes — xadestroy() frees all internal xarray nodes when the qrtrnode is released, preventing the leak.
[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43041?
CVE-2026-43041 has been classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2026-43041?
To fix CVE-2026-43041, update your Linux kernel to the latest version that includes the patch addressing this memory leak.
What kind of vulnerability is CVE-2026-43041?
CVE-2026-43041 is a memory leak vulnerability in the Linux kernel's qrtr module.
Is CVE-2026-43041 exploitable remotely?
CVE-2026-43041 is not considered directly exploitable remotely but can lead to system instability if not addressed.
Which systems are affected by CVE-2026-43041?
Systems running affected versions of the Linux kernel, specifically those utilizing the qrtr module, are vulnerable to CVE-2026-43041.