Skip to main content

Linux Kernel CVE-2026-43041

| EUVDEUVD-2026-26640 MEDIUM
Memory Leak (CWE-401)
2026-05-01 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack vector and low-privilege user required; impact is purely availability-based memory exhaustion with no data disclosure or integrity modification.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Generated
Jul 24, 2026 - 01:14 vuln.today
CVSS changed
May 08, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
EUVD ID Assigned
May 01, 2026 - 15:00 euvd
EUVD-2026-26640
CVE Published
May 01, 2026 - 14:15 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

__radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values.

The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes - xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak.

[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/

AnalysisAI

Memory exhaustion denial of service in the Linux kernel's QRTR (Qualcomm IPC Router) networking subsystem allows a local low-privileged user to leak kernel memory by triggering mid-allocation failures in the deprecated radix_tree API used for qrtr_tx_flow tracking. Orphaned intermediate radix tree nodes accumulate permanently because radix_tree_for_each_slot() only visits leaf slots and standard cleanup paths never reclaim them. The fix migrates to xarray, whose xa_destroy() correctly frees all internal nodes; no active exploitation is confirmed (EPSS 0.02%, no KEV listing), making this a routine patch-cycle priority rather than an emergency response.

Technical ContextAI

The vulnerability resides in the net/qrtr subsystem of the Linux kernel, which implements the Qualcomm IPC Router protocol used for inter-processor communication on Qualcomm SoC-based systems. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): the deprecated radix_tree API's __radix_tree_create() function allocates and links intermediate (non-leaf) tree nodes incrementally. When a later allocation in the sequence fails, previously-linked intermediate nodes remain attached to the tree with no associated leaf value. Because radix_tree_for_each_slot() only iterates slots containing leaf values, and because radix_tree_free_nodes() is not invoked for partial trees, these orphaned internal nodes are permanently stranded in kernel memory. The xarray replacement (xa_destroy()) walks and frees all internal nodes unconditionally on teardown, eliminating the leak. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel version: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, or 7.0. Stable-tree patch commits are available at git.kernel.org/stable/c/ for each branch (references: f2dd9aaf6e2861, 4b75ff0aedd6ad, ff134cc43972d7, 0fda873092b541, 69402908e277dd, f2664bc4f0f356, 5d2249eefaca59, 2428083101f688). Ubuntu users should apply the fix from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1); Red Hat and SUSE users should monitor their security channels. On systems where the qrtr module is not operationally required, blacklisting it (adding 'blacklist qrtr' to /etc/modprobe.d/blacklist.conf and running depmod -a) eliminates the attack surface entirely with no functional impact on non-Qualcomm-IPC workloads. This workaround is low-risk on x86 servers and standard ARM servers that do not rely on Qualcomm inter-processor messaging.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43041 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy