Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-43041

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak __radix_tree_create() allocates and links intermediat…

Published May 1, 2026CWE-401EPSS 0.16%

Overview

CVE-2026-43041 is a medium-severity vulnerability. It was published on May 1, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

__radix_tree_create() allocates and links intermediate nodes into the

tree one by one. If a subsequent allocation fails, the already-linked

nodes remain in the tree with no corresponding leaf entry. These orphaned

internal nodes are never reclaimed because radix_tree_for_each_slot()

only visits slots containing leaf values.

The radix_tree API is deprecated in favor of xarray. As suggested by

Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead

of fixing the radix_tree itself [1]. xarray properly handles cleanup of

internal nodes — xa_destroy() frees all internal xarray nodes when the

qrtr_node is released, preventing the leak.

[1] https://lore.kernel.org/all/[email protected]/T/

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/0fda873092b541bb5a9b87d728a2429f863f8cfaRefgit.kernel.org/stable/c/2428083101f6883f979cceffa76cd8440751ffe6Refgit.kernel.org/stable/c/4b75ff0aedd6ade1018ad4a3a9d8336794e36e42Refgit.kernel.org/stable/c/5d2249eefaca59908fe3c264b8eca526424dcfbeRefgit.kernel.org/stable/c/69402908e277dd164bf8d7c8fd0513c0fac28e9eRefgit.kernel.org/stable/c/f2664bc4f0f356f17c2094587a2b3665e3867e44Refgit.kernel.org/stable/c/f2dd9aaf6e2861337f5835f877a5b2becaf4b015Refgit.kernel.org/stable/c/ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3

How CyberStrike helps

Frequently asked questions

What is CVE-2026-43041?

CVE-2026-43041 is a medium-severity vulnerability. It was published on May 1, 2026 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2026-43041?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-43041?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-43041?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-43041 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999