PT-2026-41873 · Linux · Linux Kernel

Published 2026-05-19 · Updated 2026-05-25 · CVE-2026-43491

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The net: qrtr: ns component lacks bound checking on the number of servers added per node. A malicious client can exhaust memory by flooding the system with NEW SERVER messages. The issue is handled within the qrtr ns worker() function.

Recommendations Limit the maximum number of server registrations to 256 per node. Rate limit the error messages in the failure path of the qrtr ns worker() function.

Related Identifiers

CVE-2026-43491

ECHO-2EDD-6081-9C80

OPENSUSE-SU-2026:10859-1

Affected Products

Linux Kernel

References · 25

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43491 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43491 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43491 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43491 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43491 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-43491 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10859-1 · Vendor Advisory
• https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c · Note
• https://suse.com/security/cve/CVE-2026-43492 · Note
• https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d · Note
• https://suse.com/security/cve/CVE-2026-43493 · Note
• https://suse.com/security/cve/CVE-2026-43495 · Note
• https://suse.com/security/cve/CVE-2026-43498 · Note
• https://suse.com/security/cve/CVE-2026-43491 · Note