Medium severity · published May 27, 2026
CVE-2026-46038
net: qrtr: ns: Free the node during ctrl_cmd_bye()
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: ns: Free the node during ctrl_cmd_bye()
A node sends the BYE packet when it is about to go down. So the nameserver
should advertise the removal of the node to all remote and local observers
and free the node finally. But currently, the nameserver doesn't free the
node memory even after processing the BYE packet. This causes the node
memory to leak.
Hence, remove the node from Xarray list and free the node memory during
both success and failure case of ctrl_cmd_bye().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.7 before 6.6.140; 6.7 before 6.12.86; 6.13 before 6.18.27; 6.19 before 7.0.4 · source: NVD
LI
Linux · Linux
0c2204a4ad710d95d348ea006f14ba926e842ffd before 6c9cca46acb6f22e63f015ea7b2ed6032d2badf5; 0c2204a4ad710d95d348ea006f14ba926e842ffd before a5a454f3364877b22f0e5a165df8b3702ff96ae7; 0c2204a4ad710d95d348ea006f14ba926e842ffd before 25d580a46b079a7963ff024a5195e547baf12b64; 0c2204a4ad710d95d348ea006f14ba926e842ffd before ff78ed177a66763085e3214d6fbe13ca8f0b3f11; 0c2204a4ad710d95d348ea006f14ba926e842ffd before 65932f5102bb5377db36c8a4f0c28179a1967a9a; 0c2204a4ad710d95d348ea006f14ba926e842ffd before 154fc7fe3f62c46891c3c4302f4b5b5391c932e6; +3 more · source: vendor
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46038
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46038
Patch
https://git.kernel.org/stable/c/076e4b162d6caba12c229e7f262df5b6881162b0
Patch
https://git.kernel.org/stable/c/154fc7fe3f62c46891c3c4302f4b5b5391c932e6
git.kernel.org
https://git.kernel.org/stable/c/25d580a46b079a7963ff024a5195e547baf12b64
Patch
https://git.kernel.org/stable/c/65932f5102bb5377db36c8a4f0c28179a1967a9a
Patch
https://git.kernel.org/stable/c/68efba36446a7774ea5b971257ade049272a07ac
git.kernel.org
https://git.kernel.org/stable/c/6c9cca46acb6f22e63f015ea7b2ed6032d2badf5
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability