VulnerabilityPublished 27 May 2026Updated 6 Nov 2026

CVE-2026-46038: Linux kernel · net: qrtr: ns: Free the node during ctrl_cmd_bye()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ff78ed177a66763085e3214d6fbe13ca8f0b3f11 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:34 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ff78ed177a66763085e3214d6fbe13ca8f0b3f11, a5a454f3364877b22f0e5a165df8b3702ff96ae7, 65932f5102bb5377db36c8a4f0c28179a1967a9a +5

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < ff78ed177a66763085e3214d6fbe13ca8f0b3f11	Fixed in ff78ed177a66763085e3214d6fbe13ca8f0b3f11
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < a5a454f3364877b22f0e5a165df8b3702ff96ae7	Fixed in a5a454f3364877b22f0e5a165df8b3702ff96ae7
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 65932f5102bb5377db36c8a4f0c28179a1967a9a	Fixed in 65932f5102bb5377db36c8a4f0c28179a1967a9a
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 154fc7fe3f62c46891c3c4302f4b5b5391c932e6	Fixed in 154fc7fe3f62c46891c3c4302f4b5b5391c932e6
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 076e4b162d6caba12c229e7f262df5b6881162b0	Fixed in 076e4b162d6caba12c229e7f262df5b6881162b0
LinuxLinux	Affected ≥ 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 68efba36446a7774ea5b971257ade049272a07ac	Fixed in 68efba36446a7774ea5b971257ade049272a07ac

Description

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Free the node during ctrl_cmd_bye() A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak. Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye().

References

Community reviews

Loading reviews…