CVE-2026-97440: net: qrtr: fix node refcount leak on ctrl packet alloc failure
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix node refcount leak on ctrl packet alloc failure
qrtrsendresumetx() calls qrtrnodelookup() which takes a reference on the returned node. If the subsequent call to qrtrallocctrlpacket() fails due to memory allocation failure, the function returns -ENOMEM without calling qrtrnoderelease() to release the node reference.
Add qrtrnoderelease(node) before returning on the allocation failure path to properly release the reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net: qrtr, add qrtr_node_release(node) before returning -ENOMEM in qrtr_send_resume_tx() when qrtr_alloc_ctrl_packet() fails, releasing the reference obtained by qrtr_node_lookup().
Event History
Frequently Asked Questions
What conditions are required to trigger the leak?
The issue occurs when qrtr_send_resume_tx() successfully obtains a node reference through qrtr_node_lookup(), then qrtr_alloc_ctrl_packet() fails because memory allocation fails. The failure path returns -ENOMEM without releasing the acquired node reference.
What is the impact if the condition occurs?
Each affected allocation-failure path leaks a reference to the QRTR node. The provided information identifies this as a node reference-count leak; it does not state further consequences or an exploitation method.
How is the issue fixed?
The fix releases the node with qrtr_node_release(node) before returning from the control-packet allocation failure path.