Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0016 4.9 —
AFFECTED Product Versions Fixed Linux 0c2204a4ad710d95d348ea006f14ba926e842ffd – — Linux 5.7 – 5.10.265
TIMELINE May 1 Reserved by Linux May 19 Published (CNA: Linux) Aug 19 ENRICHED — CVE-2026-43491 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the maximum server registration per node Current code does no bound checking on the number of servers added per node. A malicious client can flood NEW_SERVER messages and exhaust memory. Fix this issue by limiting the maximum number of server registrations to 256 per node. If the NEW_SERVER message is received for an old port, then don't restrict it as it will get replaced. While at it, also rate limit the error messages in the failure path of qrtr_ns_worker(). Note that the limit of 256 is chosen based on the current platform requirements. If requirement changes in the future, this limit can be increased.
| Date | Event | Detail |
|---|---|---|
| May 1, 2026 | Reserved | Reserved by Linux |
| May 19, 2026 | Published | Published (CNA: Linux) |
| August 19, 2026 | ENRICHED | ENRICHED — CVE-2026-43491 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-43491 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43491 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
