CVE-2026-46038

MediumCVSS 5.5/10Last modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: ns: Free the node during ctrl_cmd_bye()

A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But currently, the nameserver doesn't free the node memory even after processing the BYE packet. This causes the node memory to leak.

Hence, remove the node from Xarray list and free the node memory during both success and failure case of ctrl_cmd_bye().

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 6c9cca46acb6f22e63f015ea7b2ed6032d2badf5; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < a5a454f3364877b22f0e5a165df8b3702ff96ae7; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 25d580a46b079a7963ff024a5195e547baf12b64; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < ff78ed177a66763085e3214d6fbe13ca8f0b3f11; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 65932f5102bb5377db36c8a4f0c28179a1967a9a; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 154fc7fe3f62c46891c3c4302f4b5b5391c932e6; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 076e4b162d6caba12c229e7f262df5b6881162b0; >= 0c2204a4ad710d95d348ea006f14ba926e842ffd, < 68efba36446a7774ea5b971257ade049272a07ac
LinuxLinux5.7
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< *

References

Timeline

Published
May 27, 2026
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-460399.8In the Linux kernel, the following vulnerability has been resolved: rxgk: Fix potential integer overflow in length check Fix potential intCVE-2026-46045.3The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check onCVE-2026-460405.5In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() faiCVE-2026-460415.5In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()CVE-2026-460425.5In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leaks in weighted_interleave_auto_store() weiCVE-2026-460439.1In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rCVE-2026-460445.5In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Clean up kthread on errors If an error occurs after the ssiCVE-2026-460457.8In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: skip reading rdevs that are not in_sync When reading bCVE-2026-460465.5In the Linux kernel, the following vulnerability has been resolved: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() The commiCVE-2026-460477.8In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Fix use-after-free in driver remove() In the remove calCVE-2026-460485.5In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix usb_dev refcount leak on probe failure create_card() CVE-2026-460495.5In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdif_passthru_pla
CVE-2026-46038: Medium severity, CVSS 5.5 | Vulnix