{"id":"CVE-2026-43491","title":"net: qrtr: ns: Limit the maximum server registration per node","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Limit the maximum server registration per node\n\nCurrent code does no bound checking on the number of servers added per\nnode. A malicious client can flood…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < b48fc702b20233b809f01053232c3cd5083c97b4","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 991c431077b19176d3fe3bb54054c063776a8cdc","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 94914731ca0b99899dceadd80d2df00584a688ca","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < e6f6cd501fb54060940a6eb3f4103eeb5e426ae7","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 3efaad55cad1ded429e3a873bfece389058a526b","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 35fb4a0c077c5d1049c2628b769e0a1b1e65df0d","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 868202aa2adae427060a42d5bd663b4d782ec02c","Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < d5ee2ff98322337951c56398e79d51815acbf955","Linux 5.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:41:13.574482Z"},"published":"2026-05-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:57.704Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43491","references":[{"url":"https://git.kernel.org/stable/c/b48fc702b20233b809f01053232c3cd5083c97b4"},{"url":"https://git.kernel.org/stable/c/991c431077b19176d3fe3bb54054c063776a8cdc"},{"url":"https://git.kernel.org/stable/c/94914731ca0b99899dceadd80d2df00584a688ca"},{"url":"https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7"},{"url":"https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b"},{"url":"https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d"},{"url":"https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c"},{"url":"https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955"}],"tags":["cve.org"],"epss":0.00149,"epssPercentile":0.04112,"ingestedAt":"2026-11-06T15:54:03.890Z","slug":"CVE-2026-43491","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Limit the maximum server registration per node\n\nCurrent code does no bound checking on the number of servers added per\nnode. A malicious client can flood NEW_SERVER messages and exhaust memory.\n\nFix this issue by limiting the maximum number of server registrations to\n256 per node. If the NEW_SERVER message is received for an old port, then\ndon't restrict it as it will get replaced. While at it, also rate limit\nthe error messages in the failure path of qrtr_ns_worker().\n\nNote that the limit of 256 is chosen based on the current platform\nrequirements. If requirement changes in the future, this limit can be\nincreased.\n\n## Affected\n\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < b48fc702b20233b809f01053232c3cd5083c97b4`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 991c431077b19176d3fe3bb54054c063776a8cdc`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 94914731ca0b99899dceadd80d2df00584a688ca`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < e6f6cd501fb54060940a6eb3f4103eeb5e426ae7`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 3efaad55cad1ded429e3a873bfece389058a526b`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 35fb4a0c077c5d1049c2628b769e0a1b1e65df0d`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < 868202aa2adae427060a42d5bd663b4d782ec02c`\n- `Linux >= 0c2204a4ad710d95d348ea006f14ba926e842ffd < d5ee2ff98322337951c56398e79d51815acbf955`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}