GHSA-vfqf-4c37-r857 · Severity: unknown — In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the...
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.
Conclusion & alert: CVE-2026-43491 is rated Low Risk (4.9/100): low exploitation likelihood (EPSS 0.02%). Mandatory action: Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-19 | — | 0.02% | — |
Full EPSS history (1 record total)
CVSS metrics for this CVE.
No CVSS data in dataset for this CVE.
GHSA-vfqf-4c37-r857 · Severity: unknown — In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-43491 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 3, open 2. | https://security-tracker.debian.org/tracker/CVE-2026-43491 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-43491 |
suse
|
medium | CVE-2026-43491 severity moderate: SUSE including 14 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 53 product×package rows across 12 product lines (SUSE Linux Enterprise Live Patching 12 SP5, SUSE Linux Enterprise Micro 5.0, … (12 product lines)): Known Not Affected 53. | https://www.suse.com/security/cve/CVE-2026-43491/ |
ubuntu
|
medium | CVE-2026-43491 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 169, needed 98, released 83, not-affected 45, needs-triage 6. | https://ubuntu.com/security/CVE-2026-43491 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||