# CVE-2026-43491: net: qrtr: ns: Limit the maximum server registration per node Status: published. Published: 2026-05-19. Updated: 2026-11-06. In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased. ## Remediation - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955 - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7 ## Affected products and versions - Linux / Linux: ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < b48fc702b20233b809f01053232c3cd5083c97b4 (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < 991c431077b19176d3fe3bb54054c063776a8cdc (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < 94914731ca0b99899dceadd80d2df00584a688ca (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < e6f6cd501fb54060940a6eb3f4103eeb5e426ae7 (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < 3efaad55cad1ded429e3a873bfece389058a526b (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < 35fb4a0c077c5d1049c2628b769e0a1b1e65df0d (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < 868202aa2adae427060a42d5bd663b4d782ec02c (affected, git); ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd; < d5ee2ff98322337951c56398e79d51815acbf955 (affected, git). Source: CNA: Linux - Linux / Linux: 5.7 (affected); ≥ 0; < 5.7 (unaffected, semver); ≥ 5.10.265; ≤ 5.10.* (unaffected, semver); ≥ 5.15.216; ≤ 5.15.* (unaffected, semver); ≥ 6.1.183; ≤ 6.1.* (unaffected, semver); ≥ 6.6.140; ≤ 6.6.* (unaffected, semver); ≥ 6.12.86; ≤ 6.12.* (unaffected, semver); ≥ 6.18.27; ≤ 6.18.* (unaffected, semver); ≥ 7.0.4; ≤ 7.0.* (unaffected, semver); ≥ 7.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux ## NVD configuration conditions Affected CPE matches depend on the following AND/OR and negation conditions: ```json [ { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.140", "versionStartIncluding": "5.7", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.27", "versionStartIncluding": "6.13", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.0.4", "versionStartIncluding": "6.19", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" } ] ``` ## Severity and prioritization - CVSS 3.1: 5.5 (medium); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; source: NVD: nvd@nist.gov - CISA KEV: No listing in collected sources - EPSS: 0.15% as of 2026-11-06; percentile 4.13% - SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP - Weaknesses: Not reported ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://git.kernel.org/stable/c/b48fc702b20233b809f01053232c3cd5083c97b4 (CNA: Linux) - https://git.kernel.org/stable/c/991c431077b19176d3fe3bb54054c063776a8cdc (CNA: Linux) - https://git.kernel.org/stable/c/94914731ca0b99899dceadd80d2df00584a688ca (CNA: Linux) - https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7 (CNA: Linux) - https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b (CNA: Linux) - https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d (CNA: Linux) - https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c (CNA: Linux) - https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955 (CNA: Linux) - https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/94914731ca0b99899dceadd80d2df00584a688ca (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/991c431077b19176d3fe3bb54054c063776a8cdc (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/b48fc702b20233b809f01053232c3cd5083c97b4 (416baaa9-dc9f-4396-8d5f-8c081fb06d67) - https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) ## Provenance - CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-43491; retrieved 2026-11-06; source updated 2026-11-06 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-43491; retrieved 2026-11-06; source updated 2026-11-06 - FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-43491; retrieved 2026-11-06; source updated Not reported Revision: 9fd3fac09780405493035a9f807366a883dbd1f0c6d23133a1d1cf62df99ed40 Canonical: https://y2.dev/cve/CVE-2026-43491 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.