CVE-2026-43041

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

MEDIUM
5.5
CVSS Score
Published: May 1, 2026 at 02:15 PM UTC
Updated: June 17, 2026 at 10:48 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak __radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values. The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes — xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak. [1] https://lore.kernel.org/all/[email protected]/T/

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.11 ≤ v < 5.15.2035.16 ≤ v < 6.1.1685.6 ≤ v < 5.10.2535.6 ≤ v < 5.15.2035.6 ≤ v < 6.1.1685.6 ≤ v < 6.12.815.6 ≤ v < 6.18.225.6 ≤ v < 6.19.125.6 ≤ v < 6.6.1345.6 ≤ v < 7.06.13 ≤ v < 6.18.226.19 ≤ v < 6.19.126.2 ≤ v < 6.6.1346.7 ≤ v < 6.12.815.65fdeb0d372ab33b4175043a2a4a1730239a217f17.0 rc17.0 rc27.0 rc37.0 rc47.0 rc57.0 rc6
Vendor states this is fixed in 0fda873092b541bb5a9b87d728a2429f863f8cfa (fixed)
Vendor states this is fixed in 2428083101f6883f979cceffa76cd8440751ffe6 (fixed)
Vendor states this is fixed in 4b75ff0aedd6ade1018ad4a3a9d8336794e36e42 (fixed)
Vendor states this is fixed in 5d2249eefaca59908fe3c264b8eca526424dcfbe (fixed)
Vendor states this is fixed in 69402908e277dd164bf8d7c8fd0513c0fac28e9e (fixed)
Vendor states this is fixed in f2664bc4f0f356f17c2094587a2b3665e3867e44 (fixed)
Vendor states this is fixed in f2dd9aaf6e2861337f5835f877a5b2becaf4b015 (fixed)
Vendor states this is fixed in ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3 (fixed)
Vendor states this is fixed in 5.10.253 (unaffected)
Vendor states this is fixed in 5.15.203 (unaffected)
Vendor states this is fixed in 5.6 (unaffected)
Vendor states this is fixed in 6.1.168 (unaffected)
Vendor states this is fixed in 6.12.81 (unaffected)
Vendor states this is fixed in 6.18.22 (unaffected)
Vendor states this is fixed in 6.19.12 (unaffected)
Vendor states this is fixed in 6.6.134 (unaffected)
Vendor states this is fixed in 7.0 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card