CVE-2026-43491 | net: qrtr: ns: Limit the maximum server registration per node

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.

Published: 2026-05-19 Last update: 2026-05-19 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Conclusion & alert: CVE-2026-43491 is rated Low Risk (4.9/100): low exploitation likelihood (EPSS 0.02%). Mandatory action: Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-43491

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-19 0.02%

Full EPSS history (1 record total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-43491

CVSS metrics for this CVE.

No CVSS data in dataset for this CVE.

Weakness enumeration for CVE-2026-43491

GitHub Security Advisory for CVE-2026-43491

GHSA-vfqf-4c37-r857 · Severity: unknown — In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the...

OS Trackers for CVE-2026-43491

vendor priority summary link
debian not yet assigned CVE-2026-43491 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 3, open 2. https://security-tracker.debian.org/tracker/CVE-2026-43491
redhat medium https://access.redhat.com/security/cve/CVE-2026-43491
suse medium CVE-2026-43491 severity moderate: SUSE including 14 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 53 product×package rows across 12 product lines (SUSE Linux Enterprise Live Patching 12 SP5, SUSE Linux Enterprise Micro 5.0, … (12 product lines)): Known Not Affected 53. https://www.suse.com/security/cve/CVE-2026-43491/
ubuntu medium CVE-2026-43491 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 169, needed 98, released 83, not-affected 45, needs-triage 6. https://ubuntu.com/security/CVE-2026-43491

Affected software / configurations for CVE-2026-43491

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2026-43491

cvelogic Threat Intelligence