CVE-2026-46003: Linux Kernel QRTR DoS Vulnerability

CVE-2026-46003 Overview

CVE-2026-46003 is a denial-of-service vulnerability in the Linux kernel's Qualcomm IPC Router (QRTR) nameserver component. The net/qrtr/ns nameserver does not enforce any limit on the number of nodes it tracks. A malicious local client can register arbitrary, random nodes against the nameserver until kernel memory is exhausted. The upstream fix caps the maximum number of nodes at 64, a value chosen to satisfy current platform requirements while bounding resource consumption. The vulnerability falls under resource exhaustion and affects systems that load the qrtr networking subsystem, including many Qualcomm-based platforms running Linux.

Critical Impact
A local attacker can trigger kernel memory exhaustion by registering unbounded QRTR nodes, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel builds that include the net/qrtr/ns (QRTR nameserver) subsystem
Qualcomm-based platforms relying on QRTR for inter-processor IPC
Distributions shipping vulnerable Linux kernel versions prior to the fix commits referenced in the kernel.org stable tree

Discovery Timeline

2026-05-27 - CVE-2026-46003 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46003

Vulnerability Analysis

The Qualcomm IPC Router (QRTR) is a Linux networking protocol used for communication between processors on Qualcomm SoCs, such as the application processor and modem. The QRTR nameserver, implemented in net/qrtr/ns.c, tracks nodes that announce themselves on the QRTR network and resolves service lookups.

Before the patch, the nameserver allocated and retained per-node state for every registering client without enforcing an upper bound. Each newly registered node consumed additional kernel memory through associated data structures and lookup entries. An unprivileged client able to send QRTR control messages can iterate node identifiers and trigger registration for each one. Over time, the cumulative allocation pressures the kernel allocator, degrades system responsiveness, and can culminate in out-of-memory conditions or invocation of the OOM killer.

Root Cause

The root cause is missing input validation and resource bounding in the nameserver registration path. The code assumed a small, trusted set of node registrants tied to fixed platform hardware. It did not validate that the cumulative number of tracked nodes remained within a sane bound. The fix introduces an explicit cap of 64 nodes in the nameserver, rejecting registrations beyond that threshold.

Attack Vector

Exploitation requires the ability to send QRTR control traffic to the nameserver. A local user-space process with access to a QRTR socket can repeatedly register synthetic node identifiers. Each registration grows kernel allocations tied to nameserver state. No memory corruption or privilege escalation occurs; the impact is availability loss through memory exhaustion. Technical details for the fix are available in the kernel stable tree commits, including Linux Kernel Commit 27d5e84e and Linux Kernel Commit 4665a29c.

Detection Methods for CVE-2026-46003

Indicators of Compromise

Sustained growth in kernel slab allocations attributable to QRTR data structures observed via /proc/slabinfo or slabtop.
Kernel log entries from the OOM killer terminating processes on systems running the QRTR stack.
Unexpected processes opening AF_QIPCRTR sockets and issuing repeated QRTR_TYPE_HELLO or QRTR_TYPE_NEW_SERVER control messages.

Detection Strategies

Audit kernel versions across Linux fleets and flag hosts running QRTR-enabled kernels predating the referenced stable commits.
Monitor for anomalous local processes interacting with the qrtr socket family, which is uncommon outside of system services on Qualcomm platforms.
Correlate sudden kernel memory pressure events with QRTR socket activity to identify potential abuse.

Monitoring Recommendations

Track per-host kernel memory metrics and alert on rapid slab cache growth that does not correspond to legitimate workload changes.
Collect dmesg and journalctl -k output for OOM events, QRTR warnings, and nameserver-related messages.
Inventory loaded kernel modules and flag systems where qrtr and qrtr-ns are present on hosts that do not require Qualcomm IPC.

How to Mitigate CVE-2026-46003

Immediate Actions Required

Update affected Linux kernels to versions containing the stable-tree fix that introduces the 64-node cap in the QRTR nameserver.
On systems that do not require QRTR, blacklist or unload the qrtr and qrtr-ns modules to remove the attack surface.
Restrict local access on multi-tenant or shared Linux hosts where QRTR must remain loaded.

Patch Information

The fix is published in the Linux kernel stable tree across multiple branches. Reference commits include 27d5e84e810b, 4665a29c08e1, 4c4641366143, 5cf6d5e5e3b8, and 8022876894d0. Distribution-provided kernel updates that incorporate these commits remediate the issue.

Workarounds

Unload the QRTR modules on systems that do not need Qualcomm IPC: modprobe -r qrtr-ns qrtr.
Add a modprobe blacklist entry for qrtr to prevent the module from loading at boot on non-Qualcomm systems.
Limit which local users can create AF_QIPCRTR sockets through Linux Security Module (LSM) policy, such as SELinux or AppArmor.

bash

# Configuration example: prevent QRTR module load on hosts that do not need it
echo 'blacklist qrtr'    | sudo tee /etc/modprobe.d/qrtr.conf
echo 'blacklist qrtr-ns' | sudo tee -a /etc/modprobe.d/qrtr.conf

# Unload currently loaded modules (if not in use)
sudo modprobe -r qrtr-ns qrtr

# Verify removal
lsmod | grep qrtr