PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46026 Linux CVE debrief

A vulnerability in the Linux kernel's Qualcomm IPC Router (QRTR) nameserver allows a malicious local client to exhaust system resources by sending an unbounded number of NEW_LOOKUP messages. The QRTR protocol facilitates communication between Qualcomm subsystem components, and its nameserver component previously performed no bound checking on lookup operations. While the code restricts lookups to local clients, a single malicious local client could flood the socket with lookup requests, potentially causing denial of service through resource exhaustion. The fix implements a global maximum of 64 concurrent lookups across all clients, which is sufficient given that the nameserver permits only one local observer. This limit was selected based on current platform requirements and can be adjusted if future needs change. The vulnerability was resolved by introducing a hard cap on lookup operations to prevent uncontrolled resource consumption.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Organizations running Linux on Qualcomm-based hardware, embedded systems using QRTR for inter-processor communication, telecommunications infrastructure, mobile device management platforms, and security teams responsible for kernel-level vulnerability management in constrained or high-availability environments.

Technical summary

The QRTR (Qualcomm IPC Router) nameserver in the Linux kernel failed to enforce limits on the number of lookup operations a client could perform. A malicious local client could exploit this by sending a flood of NEW_LOOKUP messages over the same socket, potentially causing resource exhaustion and denial of service. The vulnerability exists because the code only restricts lookups to local clients without implementing rate limiting or maximum bounds. The resolution introduces a global maximum of 64 concurrent lookups, which is adequate given the architectural constraint of permitting only one local observer in the nameserver design.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm QRTR nameserver component is present, particularly on Qualcomm-based systems or embedded Linux deployments
  • Apply kernel updates containing the fix commits once available through distribution channels
  • Monitor for kernel packages addressing CVE-2026-46026 in security advisories from Linux distribution vendors
  • Consider local access controls to limit exposure to untrusted local users where QRTR is required
  • Assess whether QRTR/nameserver functionality can be disabled or restricted if not required for system operation

Evidence notes

The vulnerability description indicates this issue was resolved in the Linux kernel's QRTR nameserver component. The fix limits maximum lookups to 64 globally. Multiple stable kernel branch commits are referenced, indicating backports to supported kernel versions. The NVD entry shows status 'Awaiting Analysis' with no CVSS score assigned at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46026 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46026

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46026 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46026

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0dbec101a7076e9b1e4bd1876f7cf07c56ff4ce3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/20855cef7e659ef84ac73251256fa530819b2346

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2b930bc77e00cb27e1d6e1d497b3b596283465ef

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5640227d9a21c6a8be249a10677b832e7f40dc55

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/76adf8f69b0bb3ab20be7c58f5d555027332d113

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.