CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: ns: Limit the maximum server registration per node
Current code does no bound checking on the number of servers added per node. A malicious client can flood NEWSERVER messages and exhaust memory.
Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEWSERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtrnsworker().
Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Implement a bound check in the NEW_SERVER message handling to cap the maximum number of server registrations per node at 256 (as chosen for the current platform), so a malicious client cannot flood NEW_SERVER messages and exhaust memory.
Linux kernel net: qrtr: ns (qrtr_ns_worker) maximum server registrations per node = 256 per node - Configuration
Add rate limiting to NEW_SERVER handling ("While at it, also rate limit") to further mitigate flooding of NEW_SERVER messages.
Linux kernel net: qrtr: ns NEW_SERVER processing rate limiting = rate limited - Configuration
Ensure that when a NEW_SERVER message is received for an old port, it follows the described failure path behavior (including updating the error messages in qrtr_ns_worker() failure path) rather than allowing additional server registrations.
Linux kernel net: qrtr: ns (error messages / failure path of qrtr_ns_worker()) failure path error message behavior = handle old-port NEW_SERVER without server registration
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43491?
CVE-2026-43491 has a medium severity due to the potential for server registration flooding by malicious clients.
How do I fix CVE-2026-43491?
To fix CVE-2026-43491, update the Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2026-43491?
CVE-2026-43491 affects the Linux kernel, potentially impacting all distributions that utilize this component.
What are the risks associated with CVE-2026-43491?
The risks associated with CVE-2026-43491 include denial of service due to excessive server registrations, which may disrupt legitimate traffic.
Is there a workaround for CVE-2026-43491?
Currently, the best approach is to update the Linux kernel as there are no well-documented workarounds for CVE-2026-43491.