CVE-2026-46003net: qrtr: ns: Limit the total number of nodes
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory exhaustion. Hence, limit the maximum number of nodes to 64. Note that, limit of 64 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0c2204a4ad710d95d348ea006f14ba926e842ffd before b703ee903b24974aca4bde99c7d25d66309d35dd; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 823310645065bd49666e84af689fa95192819f55; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before ed29887286aba96d1930f4ddb9f235f6b421073c; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 4c46413661431aa60fb134cd4ecdf8beaa39f824; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 4665a29c08e1b36bc9db4814f9dde3d23e8fd1b0; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 5cf6d5e5e3b804a44692fbf548a5179442e2e923; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 8022876894d09ae485b499058c3357da683bcc5d; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 27d5e84e810b0849d08b9aec68e48570461ce313 | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.7 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4 | NVD |
References
- https://git.kernel.org/stable/c/b703ee903b24974aca4bde99c7d25d66309d35dd
- https://git.kernel.org/stable/c/823310645065bd49666e84af689fa95192819f55
- https://git.kernel.org/stable/c/ed29887286aba96d1930f4ddb9f235f6b421073c
- https://git.kernel.org/stable/c/4c46413661431aa60fb134cd4ecdf8beaa39f824patch
- https://git.kernel.org/stable/c/4665a29c08e1b36bc9db4814f9dde3d23e8fd1b0patch
- https://git.kernel.org/stable/c/5cf6d5e5e3b804a44692fbf548a5179442e2e923patch
- https://git.kernel.org/stable/c/8022876894d09ae485b499058c3357da683bcc5dpatch
- https://git.kernel.org/stable/c/27d5e84e810b0849d08b9aec68e48570461ce313patch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.