CVE-2026-46026: Linux Kernel QRTR DoS Vulnerability

CVE-2026-46026 Overview

CVE-2026-46026 is a Linux kernel vulnerability in the Qualcomm IPC Router (QRTR) nameserver subsystem (net/qrtr/ns). The flaw stems from missing bound checking on the number of lookups a local client can register over a single socket. A malicious local process can flood the nameserver with NEW_LOOKUP messages, exhausting kernel resources through unbounded allocation. The upstream fix caps the global lookup count at 64, which aligns with current platform requirements and the nameserver's single-observer model.

Critical Impact
A local unprivileged process can trigger resource exhaustion in the kernel QRTR nameserver by issuing an unbounded number of NEW_LOOKUP requests, leading to denial of service.

Affected Products

Linux kernel net/qrtr/ns (nameserver) implementations prior to the fix
Stable kernel branches receiving backports referenced in git.kernel.org commits
Platforms relying on QRTR for Qualcomm IPC routing (mobile, embedded, automotive)

Discovery Timeline

2026-05-27 - CVE-2026-46026 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46026

Vulnerability Analysis

QRTR is the Linux kernel's Qualcomm IPC Router protocol, which provides socket-based message passing between services on Qualcomm platforms. The QRTR nameserver tracks service registrations and observer lookups so that clients can locate services as they appear and disappear. Each NEW_LOOKUP control message instructs the nameserver to track interest in a service for a calling client.

The vulnerable code accepted NEW_LOOKUP messages without enforcing an upper bound on the number of concurrent lookups. Although the code path is restricted to local clients, a misbehaving or malicious process on the system can issue lookup requests in a tight loop. Each accepted lookup consumes kernel memory for tracking structures, producing a resource exhaustion condition under sustained abuse.

The upstream fix introduces a global cap of 64 lookups in the nameserver. Because the nameserver permits only one local observer, a single global counter is sufficient to keep the lookup table bounded.

Root Cause

The root cause is missing input validation on the rate and quantity of NEW_LOOKUP control messages, classifying the issue under Denial of Service via Resource Exhaustion. No counter or quota gated allocation of lookup tracking structures.

Attack Vector

Exploitation requires local access to a system running an affected kernel with QRTR enabled. The attacker opens a QRTR socket and repeatedly sends NEW_LOOKUP control messages over that socket. Each message causes the nameserver to allocate tracking state until kernel memory pressure or related limits degrade system availability. Remote exploitation is not applicable because the message path is restricted to local clients.

No verified exploit code is published. See the upstream commit references on git.kernel.org for the precise patch logic that introduces the 64-lookup limit.

Detection Methods for CVE-2026-46026

Indicators of Compromise

Sudden growth of kernel slab allocations associated with QRTR nameserver structures.
Unexpected processes opening AF_QIPCRTR sockets and issuing high volumes of control messages.
System logs showing degraded service registration or lookup behavior on Qualcomm platforms.

Detection Strategies

Audit running kernel version against the fixed commits referenced in the Kernel Git Commit Update advisories.
Monitor for processes invoking socket(AF_QIPCRTR, ...) outside of expected platform services.
Track per-process socket activity and message rates targeting the QRTR nameserver.

Monitoring Recommendations

Enable kernel memory pressure alerts and watch for anomalous slab growth tied to QRTR.
Collect auditd records for socket syscalls and correlate non-system users opening QRTR sockets.
Forward kernel logs and audit events to a centralized analytics platform for baseline deviation analysis.

How to Mitigate CVE-2026-46026

Immediate Actions Required

Apply the stable kernel update containing the lookup limit patch on all affected systems.
Restrict local code execution on Qualcomm platforms by enforcing least-privilege user policies.
Inventory devices that load the qrtr and qrtr-ns modules to prioritize patching.

Patch Information

The fix is merged in the Linux stable tree. Refer to the upstream commits: 0dbec101a707, 20855cef7e65, 2b930bc77e00, 5640227d9a21, and 76adf8f69b0b. The patch enforces a maximum of 64 global lookups in the QRTR nameserver.

Workarounds

Unload or blacklist the qrtr and qrtr-ns kernel modules on systems that do not require Qualcomm IPC routing.
Use Linux Security Modules (SELinux or AppArmor) to deny AF_QIPCRTR socket access for untrusted users.
Apply seccomp profiles to container workloads to block creation of QRTR sockets where not needed.

bash

# Configuration example: blacklist QRTR modules if unused
echo 'blacklist qrtr' | sudo tee /etc/modprobe.d/blacklist-qrtr.conf
echo 'blacklist qrtr-ns' | sudo tee -a /etc/modprobe.d/blacklist-qrtr.conf
sudo update-initramfs -u