In the Linux kernel

CVE-2026-43491 is an unbounded resource-allocation bug in Linux QRTR name service handling (net/qrtr/ns.c). A malicious client can keep sending NEW_SERVER registrations with new ports, and the kernel keeps allocating tracking objects until memory pressure or OOM becomes the real payload. Upstream metadata ties the bug to code introduced by commit 0c2204a4ad71 and semver exposure starting at Linux 5.7; upstream-fixed lines are listed as 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1.

There is no vendor CVSS baseline, so this is a first-principles assessment. In practice, this lands at = ASSESSED AT MEDIUM because it is local/post-initial-access, availability-only, and feature-gated by QRTR support, which is a much smaller population than generic Linux kernel networking flaws. The kernel impact is real on affected hosts, but the reachable population is too narrow for a HIGH.

Why this verdict

• Requires local or already-compromised code execution: the attacker must run code on the box, or in a container with usable access to the host kernel socket API. That is post-initial-access, which is immediate downward pressure on severity.
• Feature-gated population: QRTR is a specialized Qualcomm IPC subsystem, not a default enterprise edge service. Requiring CONFIG_QRTR or a loaded qrtr module sharply narrows the reachable population compared with generic kernel bugs.
• Availability-only outcome: the patch addresses memory exhaustion and log noise, not privilege escalation or arbitrary code execution. Crashing a host matters, but it does not justify HIGH on its own when the attacker is already local.
• No exploitation signal: EPSS is very low, the CVE is not in KEV, and the reviewed sources do not show a public exploitation campaign. That removes the main amplifier that would otherwise push an awkward local-kernel bug upward.

Why not higher?

There is no credible remote unauthenticated path here based on the reviewed sources. To get impact, the attacker already needs a foothold on a QRTR-enabled system, and the blast radius is usually one host's availability rather than cross-tenant compromise or data exposure.

Why not lower?

This is still kernel-space DoS from an unprivileged position on affected systems, which matters in shared compute, developer workstations, CI runners, and embedded Linux fleets. If QRTR is enabled and untrusted code can run locally, the bug is practical enough that writing it off as LOW would understate operational risk.

1. Unload or blacklist qrtr where unused — If a host does not need Qualcomm IPC Router, remove the attack surface entirely by unloading the module and blacklisting it from reload. For a MEDIUM verdict there is no mitigation SLA, but this is the cleanest exposure reduction while you work toward patching within the 365-day remediation window.
2. Block untrusted workloads from QIPCRTR sockets — Use seccomp, SELinux/AppArmor, or container runtime policy to deny AF_QIPCRTR from untrusted containers and local workloads. There is no mitigation SLA — go straight to the 365-day remediation window, but this is the best temporary control on shared hosts where QRTR must remain enabled.
3. Watch for QRTR abuse indicators — Add host detections for unusual QIPCRTR socket creation, rapid NEW_SERVER-like registration behavior, OOM-killer events, and qrtr_ns_worker() errors. For a MEDIUM issue this is containment and hunting support rather than an SLA-driven emergency mitigation.

Run this on the target Linux host as root or with read access to /proc/config.gz, /boot/config-*, and /lib/modules. Invoke it as sudo bash ./check-cve-2026-43491.sh; it outputs VULNERABLE, PATCHED, or UNKNOWN based on QRTR presence plus the upstream fixed-version floors.

#!/usr/bin/env bash
# check-cve-2026-43491.sh
# Determine practical exposure to CVE-2026-43491 on a Linux host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

KREL="$(uname -r)"
BASE="$(printf '%s' "$KREL" | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+' || true)"

ver_ge() {
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

ver_lt() {
  [ "$1" != "$2" ] && ! ver_ge "$1" "$2"
}

get_config_line() {
  local key="$1"
  if [ -r /proc/config.gz ]; then
    zgrep -E "^${key}=" /proc/config.gz 2>/dev/null && return 0
  fi
  if [ -r "/boot/config-$KREL" ]; then
    grep -E "^${key}=" "/boot/config-$KREL" 2>/dev/null && return 0
  fi
  if [ -r "/lib/modules/$KREL/build/.config" ]; then
    grep -E "^${key}=" "/lib/modules/$KREL/build/.config" 2>/dev/null && return 0
  fi
  return 1
}

QRTR_CFG="$(get_config_line CONFIG_QRTR || true)"
QRTR_PRESENT=no
QRTR_REASON=""

if printf '%s' "$QRTR_CFG" | grep -qE '^CONFIG_QRTR=(y|m)$'; then
  QRTR_PRESENT=yes
  QRTR_REASON="CONFIG_QRTR enabled"
elif lsmod 2>/dev/null | awk '{print $1}' | grep -qx 'qrtr'; then
  QRTR_PRESENT=yes
  QRTR_REASON="qrtr module loaded"
elif modinfo qrtr >/dev/null 2>&1; then
  QRTR_PRESENT=yes
  QRTR_REASON="qrtr module available"
fi

if [ "$QRTR_PRESENT" = no ]; then
  echo "PATCHED - QRTR support not detected (CONFIG_QRTR absent and qrtr module not present/loaded)"
  exit 0
fi

if [ -z "$BASE" ]; then
  echo "UNKNOWN - unable to parse kernel version from uname -r: $KREL; $QRTR_REASON"
  exit 2
fi

# Upstream unaffected floors from published CVE metadata:
# 6.6.140, 6.12.86, 6.18.27, 7.0.4, 7.1-rc1
# Distros may backport earlier, so unsupported/custom branches remain UNKNOWN.

if ver_lt "$BASE" "5.7.0"; then
  echo "PATCHED - kernel base version $BASE predates the vulnerable semver range; $QRTR_REASON"
  exit 0
fi

case "$BASE" in
  6.6.*)
    if ver_ge "$BASE" "6.6.140"; then
      echo "PATCHED - upstream fixed floor met on 6.6.y ($BASE >= 6.6.140); $QRTR_REASON"
      exit 0
    else
      echo "VULNERABLE - upstream 6.6.y kernel below fixed floor ($BASE < 6.6.140); $QRTR_REASON"
      exit 1
    fi
    ;;
  6.12.*)
    if ver_ge "$BASE" "6.12.86"; then
      echo "PATCHED - upstream fixed floor met on 6.12.y ($BASE >= 6.12.86); $QRTR_REASON"
      exit 0
    else
      echo "VULNERABLE - upstream 6.12.y kernel below fixed floor ($BASE < 6.12.86); $QRTR_REASON"
      exit 1
    fi
    ;;
  6.18.*)
    if ver_ge "$BASE" "6.18.27"; then
      echo "PATCHED - upstream fixed floor met on 6.18.y ($BASE >= 6.18.27); $QRTR_REASON"
      exit 0
    else
      echo "VULNERABLE - upstream 6.18.y kernel below fixed floor ($BASE < 6.18.27); $QRTR_REASON"
      exit 1
    fi
    ;;
  7.0.*)
    if ver_ge "$BASE" "7.0.4"; then
      echo "PATCHED - upstream fixed floor met on 7.0.y ($BASE >= 7.0.4); $QRTR_REASON"
      exit 0
    else
      echo "VULNERABLE - upstream 7.0.y kernel below fixed floor ($BASE < 7.0.4); $QRTR_REASON"
      exit 1
    fi
    ;;
  7.1.*|7.2.*|7.3.*|8.*)
    echo "PATCHED - mainline/newer than the original fix point (>= 7.1 line); $QRTR_REASON"
    exit 0
    ;;
  *)
    echo "UNKNOWN - QRTR is present, but $BASE is a branch where backports/custom vendor patching must be checked against distro advisories; $QRTR_REASON"
    exit 2
    ;;
esac

Sources

1. NVD CVE record
2. GitHub Advisory Database
3. Vulnerability-Lookup enriched CVE metadata
4. Linux stable patch review for 6.12
5. Ubuntu CVE page
6. SUSE CVE page
7. Microsoft MSRC VEX for Azure Linux
8. Kernel config reference for CONFIG_QRTR