5.5
MEDIUM
CVSS 3.1
CVE-2026-46038
net: qrtr: ns: Free the node during ctrl_cmd_bye()
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Free the node during ctrl_cmd_bye() A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak. Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye().
Details
INFO
Published Date :
May 27, 2026, 2:17 p.m.
Last Modified :
June 19, 2026, 1:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
Free node memory after processing BYE packet to prevent leaks.
- Remove node from Xarray list.
- Free node memory in all cases.
- Apply the patch to the kernel.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46038.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46038 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46038
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46038 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46038 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/25d580a46b079a7963ff024a5195e547baf12b64 Added Reference https://git.kernel.org/stable/c/6c9cca46acb6f22e63f015ea7b2ed6032d2badf5 Added Reference https://git.kernel.org/stable/c/a5a454f3364877b22f0e5a165df8b3702ff96ae7 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': 'ff78ed177a66763085e3214d6fbe13ca8f0b3f11', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '65932f5102bb5377db36c8a4f0c28179a1967a9a', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '154fc7fe3f62c46891c3c4302f4b5b5391c932e6', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '076e4b162d6caba12c229e7f262df5b6881162b0', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '68efba36446a7774ea5b971257ade049272a07ac', 'versionType': 'git'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.27', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.4', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '6c9cca46acb6f22e63f015ea7b2ed6032d2badf5', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': 'a5a454f3364877b22f0e5a165df8b3702ff96ae7', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '25d580a46b079a7963ff024a5195e547baf12b64', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': 'ff78ed177a66763085e3214d6fbe13ca8f0b3f11', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '65932f5102bb5377db36c8a4f0c28179a1967a9a', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '154fc7fe3f62c46891c3c4302f4b5b5391c932e6', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '076e4b162d6caba12c229e7f262df5b6881162b0', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '68efba36446a7774ea5b971257ade049272a07ac', 'versionType': 'git'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.27', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.4', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': 'ff78ed177a66763085e3214d6fbe13ca8f0b3f11', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '65932f5102bb5377db36c8a4f0c28179a1967a9a', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '154fc7fe3f62c46891c3c4302f4b5b5391c932e6', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '076e4b162d6caba12c229e7f262df5b6881162b0', 'versionType': 'git'}, {'status': 'affected', 'version': '0c2204a4ad710d95d348ea006f14ba926e842ffd', 'lessThan': '68efba36446a7774ea5b971257ade049272a07ac', 'versionType': 'git'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.27', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.4', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/qrtr/ns.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-401 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.86 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.27 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.7 up to (excluding) 6.6.140 Added Reference Type kernel.org: https://git.kernel.org/stable/c/076e4b162d6caba12c229e7f262df5b6881162b0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/154fc7fe3f62c46891c3c4302f4b5b5391c932e6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/65932f5102bb5377db36c8a4f0c28179a1967a9a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/68efba36446a7774ea5b971257ade049272a07ac Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ff78ed177a66763085e3214d6fbe13ca8f0b3f11 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 27, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Free the node during ctrl_cmd_bye() A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak. Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye(). Added Reference https://git.kernel.org/stable/c/076e4b162d6caba12c229e7f262df5b6881162b0 Added Reference https://git.kernel.org/stable/c/154fc7fe3f62c46891c3c4302f4b5b5391c932e6 Added Reference https://git.kernel.org/stable/c/65932f5102bb5377db36c8a4f0c28179a1967a9a Added Reference https://git.kernel.org/stable/c/68efba36446a7774ea5b971257ade049272a07ac Added Reference https://git.kernel.org/stable/c/ff78ed177a66763085e3214d6fbe13ca8f0b3f11
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.