Medium 5.5Published May 27, 2026

CVE-2026-46003net: qrtr: ns: Limit the total number of nodes

Updated under an hour ago (Oct 27, 2026, 1:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory exhaustion. Hence, limit the maximum number of nodes to 64. Note that, limit of 64 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0c2204a4ad710d95d348ea006f14ba926e842ffd before b703ee903b24974aca4bde99c7d25d66309d35dd; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 823310645065bd49666e84af689fa95192819f55; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before ed29887286aba96d1930f4ddb9f235f6b421073c; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 4c46413661431aa60fb134cd4ecdf8beaa39f824; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 4665a29c08e1b36bc9db4814f9dde3d23e8fd1b0; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 5cf6d5e5e3b804a44692fbf548a5179442e2e923; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 8022876894d09ae485b499058c3357da683bcc5d; from 0c2204a4ad710d95d348ea006f14ba926e842ffd before 27d5e84e810b0849d08b9aec68e48570461ce313	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.7 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/b703ee903b24974aca4bde99c7d25d66309d35dd
https://git.kernel.org/stable/c/823310645065bd49666e84af689fa95192819f55
https://git.kernel.org/stable/c/ed29887286aba96d1930f4ddb9f235f6b421073c
https://git.kernel.org/stable/c/4c46413661431aa60fb134cd4ecdf8beaa39f824	patch
https://git.kernel.org/stable/c/4665a29c08e1b36bc9db4814f9dde3d23e8fd1b0	patch
https://git.kernel.org/stable/c/5cf6d5e5e3b804a44692fbf548a5179442e2e923	patch
https://git.kernel.org/stable/c/8022876894d09ae485b499058c3357da683bcc5d	patch
https://git.kernel.org/stable/c/27d5e84e810b0849d08b9aec68e48570461ce313	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.