CVE-2026-46038: Linux Kernel QRTR Memory Leak Vulnerability

CVE-2026-46038 Overview

CVE-2026-46038 is a memory leak vulnerability in the Linux kernel's Qualcomm IPC Router (qrtr) nameserver component. The flaw resides in the ctrl_cmd_bye() function within net/qrtr/ns.c. When a node sends a BYE packet to indicate it is going down, the nameserver advertises the removal to remote and local observers but fails to free the associated node memory. Each BYE packet handled leaves orphaned node entries in memory, depleting kernel resources over time. The upstream fix removes the node from the Xarray list and frees the memory in both success and failure paths of ctrl_cmd_bye().

Critical Impact
Sustained handling of BYE control packets causes kernel memory exhaustion, leading to denial of service on systems using the qrtr networking stack.

Affected Products

Linux kernel versions containing the unpatched net/qrtr/ns.c nameserver implementation
Systems using Qualcomm IPC Router (qrtr) for inter-processor communication
Mobile and embedded platforms relying on qrtr nameserver for service discovery

Discovery Timeline

2026-05-27 - CVE-2026-46038 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46038

Vulnerability Analysis

The Qualcomm IPC Router (qrtr) is a Linux kernel networking subsystem used for communication between processors and services on Qualcomm platforms. The nameserver component within qrtr tracks active nodes and routes service announcements between them. Nodes signal an impending shutdown by transmitting a BYE control packet, which the nameserver processes through the ctrl_cmd_bye() function.

The defect lies in the cleanup logic of ctrl_cmd_bye(). Although the function advertises node removal to local and remote observers, it never removes the node entry from the Xarray data structure and never releases the underlying node memory allocation. Each processed BYE packet therefore leaks the memory backing the node and leaves stale references in the Xarray.

In long-running systems or workloads where nodes frequently come and go, the leaked allocations accumulate. Eventually the kernel slab allocator exhausts available memory, leading to allocation failures, performance degradation, and potential denial of service. This issue falls under the [CWE-401] Memory Leak category.

Root Cause

The root cause is incomplete resource cleanup in ctrl_cmd_bye(). The function omits the calls required to remove the node from the Xarray list and to free the allocated node structure. Neither the success path nor the failure path performs these cleanup steps.

Attack Vector

A local component or peer node capable of generating qrtr BYE control packets can trigger the leak. Repeated node teardown cycles drive sustained memory consumption inside the kernel. The vulnerability does not provide code execution but degrades availability of the affected host.

The vulnerability is described in prose only because no verified proof-of-concept code is available. Refer to the upstream commits for the exact code changes that introduce the missing xa_erase() and kfree() operations.

Detection Methods for CVE-2026-46038

Indicators of Compromise

Steady growth in kernel slab memory attributable to qrtr node allocations visible in /proc/slabinfo
Increasing entry counts in qrtr nameserver Xarray structures without corresponding node activity
Kernel log messages reporting allocation failures or out-of-memory conditions on systems running qrtr workloads

Detection Strategies

Monitor kernel memory growth correlated with qrtr BYE control packet activity on affected hosts
Compare installed kernel versions against the fixed commits referenced in the upstream patches
Inspect kernel build metadata to identify systems running net/qrtr/ns.c without commits 076e4b16, 154fc7fe, 65932f51, 68efba36, or ff78ed17

Monitoring Recommendations

Track long-term trends in kernel memory utilization on Qualcomm-based mobile, automotive, and embedded fleets
Alert on unexpected kernel allocation failures or OOM-kill events on systems that use qrtr
Audit kernel version inventory regularly to ensure stable-tree updates containing the fix are applied

How to Mitigate CVE-2026-46038

Immediate Actions Required

Apply the upstream Linux kernel patches that correct cleanup in ctrl_cmd_bye() as soon as vendor-built kernels become available
Identify hosts running qrtr by checking for the qrtr and qrtr_ns kernel modules and prioritize patching them
Restrict access to interfaces capable of generating qrtr control traffic on shared or multi-tenant systems

Patch Information

The issue is resolved by upstream commits that erase the node from the Xarray and free its memory in ctrl_cmd_bye(). Relevant references include the Kernel Patch Commit 076e4b, Kernel Patch Commit 154fc7f, Kernel Patch Commit 65932f5, Kernel Patch Commit 68efba3, and Kernel Patch Commit ff78ed1.

Workarounds

Unload the qrtr and qrtr_ns modules on systems that do not require Qualcomm IPC Router functionality
Reboot affected systems periodically to reclaim leaked kernel memory until patches are deployed
Limit untrusted local processes that can send qrtr control packets through namespace and capability restrictions

bash

# Check whether qrtr is loaded and remove it if unused
lsmod | grep qrtr
sudo modprobe -r qrtr_ns qrtr

# Prevent automatic loading on systems that do not need qrtr
echo 'blacklist qrtr'    | sudo tee /etc/modprobe.d/qrtr.conf
echo 'blacklist qrtr_ns' | sudo tee -a /etc/modprobe.d/qrtr.conf