CVE-2026-43041

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak

__radix_tree_create() allocates and links intermediate nodes into the tree one by one. If a subsequent allocation fails, the already-linked nodes remain in the tree with no corresponding leaf entry. These orphaned internal nodes are never reclaimed because radix_tree_for_each_slot() only visits slots containing leaf values.

The radix_tree API is deprecated in favor of xarray. As suggested by Matthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead of fixing the radix_tree itself [1]. xarray properly handles cleanup of internal nodes — xa_destroy() frees all internal xarray nodes when the qrtr_node is released, preventing the leak.

[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before f2dd9aaf6e2861337f5835f877a5b2becaf4b015Affected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 4b75ff0aedd6ade1018ad4a3a9d8336794e36e42Affected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3Affected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 0fda873092b541bb5a9b87d728a2429f863f8cfaAffected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 69402908e277dd164bf8d7c8fd0513c0fac28e9eAffected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before f2664bc4f0f356f17c2094587a2b3665e3867e44Affected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 5d2249eefaca59908fe3c264b8eca526424dcfbeAffected 5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 2428083101f6883f979cceffa76cd8440751ffe6Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before f2dd9aaf6e2861337f5835f877a5b2becaf4b015Affected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 4b75ff0aedd6ade1018ad4a3a9d8336794e36e42Affected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3Affected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 0fda873092b541bb5a9b87d728a2429f863f8cfaAffected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 69402908e277dd164bf8d7c8fd0513c0fac28e9eAffected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before f2664bc4f0f356f17c2094587a2b3665e3867e44Affected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 5d2249eefaca59908fe3c264b8eca526424dcfbeAffected
5fdeb0d372ab33b4175043a2a4a1730239a217f1 to before 2428083101f6883f979cceffa76cd8440751ffe6Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.