CVE-2026-43041: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43041 is a memory leak vulnerability in the Linux kernel's qrtr (Qualcomm IPC Router) networking subsystem, caused by improper handling of orphaned internal nodes in the qrtr_tx_flow radix tree. When __radix_tree_create() allocates intermediate nodes sequentially and a subsequent allocation fails, already-linked internal nodes remain in the tree and are never reclaimed, because radix_tree_for_each_slot() only visits slots containing leaf values. The vulnerability affects Linux kernel versions from 5.6 through multiple stable branches, including 5.10.x before 5.10.253, 5.15.x before 5.15.203, 5.16–6.1.x before 6.1.168, 6.2–6.6.x before 6.6.134, 6.7–6.12.x before 6.12.81, 6.13–6.18.x before 6.18.22, 6.19.x before 6.19.12, and Linux 7.0 release candidates. It was published on May 1, 2026, with patches released by May 8, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). The qrtr_tx_flow data structure uses a radix tree to track transmission flow state; when __radix_tree_create() partially allocates intermediate nodes and then fails, those orphaned nodes are left linked in the tree with no corresponding leaf entry. Because radix_tree_for_each_slot() only iterates over leaf slots, the orphaned internal nodes are invisible to cleanup routines and accumulate over time. The fix, suggested by Matthew Wilcox, migrates qrtr_tx_flow from the deprecated radix_tree API to xarray, which properly frees all internal nodes via xa_destroy() when the qrtr_node is released (Github Advisory, Red Hat Bugzilla).

Exploitation of this vulnerability allows a local user with access to qrtr networking operations to trigger repeated allocation failures in the qrtr_tx_flow radix tree, causing kernel memory to leak and accumulate over time. The primary impact is a Denial of Service (DoS): as orphaned internal nodes exhaust available kernel memory, the system may become unstable or crash. There is no impact on confidentiality or data integrity (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (PR:L) to interact with qrtr networking functionality, limiting the attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

Update the Linux kernel to a patched version for the applicable stable branch: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, or 6.19.12 (and later). The fix replaces the vulnerable radix_tree implementation in qrtr_tx_flow with xarray, which properly handles cleanup of internal nodes via xa_destroy(). As a temporary workaround if patching is not immediately possible, restrict local user access to qrtr networking functionality to reduce exposure (Github Advisory, Red Hat Bugzilla).