In the Linux kernel, the QRTR nameserver does not enforce a limit on node registrations. A malicious client that can send QRTR registration messages may create a large number of random nodes, causing the kernel to allocate memory for each new node until system memory is exhausted. This results in a denial‑of‑service condition for processes relying on the nameserver.

The vulnerability affects the Linux kernel in all versions prior to the inclusion of the node‑limit change. The commit that limits the total number of nodes to 64 is the remedy, so any kernel build that does not contain this change is impacted.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the QRTR interface accepts registration messages from any client, an attacker can trigger memory exhaustion by sending a large number of node creation requests. The CVSS score of 5.5 indicates a medium severity, reflecting the potential for crashes or instability; the risk persists until the kernel is updated or an equivalent fix is applied. The attack vector involves any host capable of communicating with the QRTR interface, with no authentication required.