CVE-2026-46026 - Vulnerability Details

- net: qrtr: ns: Limit the maximum number of lookups

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: ns: Limit the maximum number of lookups

Current code does no bound checking on the number of lookups a client can
perform. Though the code restricts the lookups to local clients, there is
still a possibility of a malicious local client sending a flood of
NEW_LOOKUP messages over the same socket.

Fix this issue by limiting the maximum number of lookups to 64 globally.
Since the nameserver allows only atmost one local observer, this global
lookup count will ensure that the lookups stay within the limit.

Note that, limit of 64 is chosen based on the current platform
requirements. If requirement changes in the future, this limit can be
increased.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The qRTR nameserver in the Linux kernel performs lookups for clients but does not validate the number of requests a local client may issue. A malicious local process can send many NEW_LOOKUP messages over the same socket, exhausting kernel memory or otherwise destabilizing the system. This uncontrolled request rate can lead to resource exhaustion, causing a denial of service.

Affected Systems

Linux kernel versions that include the qRTR feature and have not applied the commit that caps lookup requests at 64 are vulnerable. All kernel releases that ship the current qRTR code path are affected until the patch is applied.

Risk and Exploitability

This flaw can be triggered by any process running on the same host, so local privilege is required. The severity is reflected by a CVSS score of 5.5, indicating medium impact. The lack of a bound introduces a significant disruption potential for local users, though no remote exploitation path is known. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0c2204a4ad710d95d348ea006f14ba926e842ffd`	affected	< 0dbec101a7076e9b1e4bd1876f7cf07c56ff4ce3
`0c2204a4ad710d95d348ea006f14ba926e842ffd`	affected	< 76adf8f69b0bb3ab20be7c58f5d555027332d113
`0c2204a4ad710d95d348ea006f14ba926e842ffd`	affected	< 20855cef7e659ef84ac73251256fa530819b2346
`0c2204a4ad710d95d348ea006f14ba926e842ffd`	affected	< 2b930bc77e00cb27e1d6e1d497b3b596283465ef
`0c2204a4ad710d95d348ea006f14ba926e842ffd`	affected	< 5640227d9a21c6a8be249a10677b832e7f40dc55

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`6.6.140`	unaffected	≤ 6.6.*
`6.12.86`	unaffected	≤ 6.12.*
`6.18.27`	unaffected	≤ 6.18.*
`7.0.4`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0c2204a4ad710d95d348ea006f14ba926e842ffd,0dbec101a7076e9b1e4bd1876f7cf07c56ff4ce3)`	affected	code_commit	—
`[0c2204a4ad710d95d348ea006f14ba926e842ffd,76adf8f69b0bb3ab20be7c58f5d555027332d113)`	affected	code_commit	—
`[0c2204a4ad710d95d348ea006f14ba926e842ffd,20855cef7e659ef84ac73251256fa530819b2346)`	affected	code_commit	—
`[0c2204a4ad710d95d348ea006f14ba926e842ffd,2b930bc77e00cb27e1d6e1d497b3b596283465ef)`	affected	code_commit	—
`[0c2204a4ad710d95d348ea006f14ba926e842ffd,5640227d9a21c6a8be249a10677b832e7f40dc55)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.86,6.13.0)`	unaffected	semver	—
`[6.18.27,6.19.0)`	unaffected	semver	—
`[7.0.4,7.1.0)`	unaffected	semver	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the qRTR lookup limit fix or merge the upstream commit that enforces a 64-lookup cap.
If a kernel upgrade cannot be performed immediately, modify the qRTR source to enforce the maximum lookup count, rebuild, and reboot with the updated kernel.
Restrict local processes that may send NEW_LOOKUP requests by applying SELinux, AppArmor, or similar local security policies to limit access to the qRTR interface.

Generated by OpenCVE AI on May 28, 2026 at 05:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0dbec101a7076e9b1e4bd1876f7cf07c56ff4ce3
https://git.kernel.org/stable/c/20855cef7e659ef84ac73251256fa530819b2346
https://git.kernel.org/stable/c/2b930bc77e00cb27e1d6e1d497b3b596283465ef
https://git.kernel.org/stable/c/5640227d9a21c6a8be249a10677b832e7f40dc55
https://git.kernel.org/stable/c/76adf8f69b0bb3ab20be7c58f5d555027332d113
https://lore.kernel.org/linux-cve-announce/2026052748-CVE-2026-46026-4b5a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-46026
https://www.cve.org/CVERecord?id=CVE-2026-46026

History

Tue, 16 Jun 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo

Thu, 28 May 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-674

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://lore.kernel.org/linux-cve-announce/2026052748-CVE-2026-46026-4b5a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-46026 https://www.cve.org/CVERecord?id=CVE-2026-46026
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 27 May 2026 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-674

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum number of lookups Current code does no bound checking on the number of lookups a client can perform. Though the code restricts the lookups to local clients, there is still a possibility of a malicious local client sending a flood of NEW_LOOKUP messages over the same socket. Fix this issue by limiting the maximum number of lookups to 64 globally. Since the nameserver allows only atmost one local observer, this global lookup count will ensure that the lookups stay within the limit. Note that, limit of 64 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.
Title		net: qrtr: ns: Limit the maximum number of lookups
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0dbec101a7076e9b1e4bd1876f7cf07c56ff4ce3 https://git.kernel.org/stable/c/20855cef7e659ef84ac73251256fa530819b2346 https://git.kernel.org/stable/c/2b930bc77e00cb27e1d6e1d497b3b596283465ef https://git.kernel.org/stable/c/5640227d9a21c6a8be249a10677b832e7f40dc55 https://git.kernel.org/stable/c/76adf8f69b0bb3ab20be7c58f5d555027332d113

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T12:56:32.596Z

Updated: 2026-06-14T17:48:53.618Z

Reserved: 2026-05-13T15:03:33.093Z

Link: CVE-2026-46026

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-27T14:17:21.160

Modified: 2026-06-16T15:54:38.600

Link: CVE-2026-46026

Redhat

Severity : Low

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-46026 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T05:45:05Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object