CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye()
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: ns: Free the node during ctrlcmdbye()
A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak.
Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrlcmdbye().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Apply the vendor-provided kernel fix that resolves the issue in net: qrtr: ns by freeing the node during ctrl_cmd_bye(), including advertising the node removal to all remote and local observers and removing it from the Xarray list so node memory is not leaked after the BYE packet.
Linux kernel (net: qrtr: ns) Free the node during ctrl_cmd_bye() = implemented (resolved behavior)
Event History
Frequently Asked Questions
What conditions are required to trigger the memory leak?
An attacker or local process needs local access with low privileges and must be able to cause QRTR nameserver processing of a node BYE control packet. The issue occurs when ctrl_cmd_bye() processes the node removal.
What is the practical impact?
Affected systems can leak node memory because the nameserver does not remove and free the node after handling its BYE packet. Repeated triggering could consume memory and result in a denial-of-service condition.
Which products are identified as affected?
The provided data identifies the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. No unaffected or fixed product versions are provided.