{"id":"CVE-2026-43041","state":"PUBLISHED","title":"net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak\n\n__radix_tree_create() allocates and links intermediate nodes into the\ntree one by one. If a subsequent allocation fails, the already-linked\nnodes remain in the tree with no corresponding leaf entry. These orphaned\ninternal nodes are never reclaimed because radix_tree_for_each_slot()\nonly visits slots containing leaf values.\n\nThe radix_tree API is deprecated in favor of xarray. As suggested by\nMatthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead\nof fixing the radix_tree itself [1]. xarray properly handles cleanup of\ninternal nodes — xa_destroy() frees all internal xarray nodes when the\nqrtr_node is released, preventing the leak.\n\n[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/","publishedAt":"2026-05-01T14:15:38.112Z","updatedAt":"2026-05-11T22:16:34.530Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"f2dd9aaf6e2861337f5835f877a5b2becaf4b015","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"4b75ff0aedd6ade1018ad4a3a9d8336794e36e42","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"0fda873092b541bb5a9b87d728a2429f863f8cfa","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"69402908e277dd164bf8d7c8fd0513c0fac28e9e","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"f2664bc4f0f356f17c2094587a2b3665e3867e44","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"5d2249eefaca59908fe3c264b8eca526424dcfbe","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"2428083101f6883f979cceffa76cd8440751ffe6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/af_qrtr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.134","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.81","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.22","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/af_qrtr.c"]}],"references":["https://git.kernel.org/stable/c/f2dd9aaf6e2861337f5835f877a5b2becaf4b015","https://git.kernel.org/stable/c/4b75ff0aedd6ade1018ad4a3a9d8336794e36e42","https://git.kernel.org/stable/c/ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3","https://git.kernel.org/stable/c/0fda873092b541bb5a9b87d728a2429f863f8cfa","https://git.kernel.org/stable/c/69402908e277dd164bf8d7c8fd0513c0fac28e9e","https://git.kernel.org/stable/c/f2664bc4f0f356f17c2094587a2b3665e3867e44","https://git.kernel.org/stable/c/5d2249eefaca59908fe3c264b8eca526424dcfbe","https://git.kernel.org/stable/c/2428083101f6883f979cceffa76cd8440751ffe6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43041.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43041","state":"PUBLISHED","datePublished":"2026-05-01T14:15:38.112Z","dateUpdated":"2026-05-11T22:16:34.530Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.978Z"},"containers":{"cna":{"title":"net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak\n\n__radix_tree_create() allocates and links intermediate nodes into the\ntree one by one. If a subsequent allocation fails, the already-linked\nnodes remain in the tree with no corresponding leaf entry. These orphaned\ninternal nodes are never reclaimed because radix_tree_for_each_slot()\nonly visits slots containing leaf values.\n\nThe radix_tree API is deprecated in favor of xarray. As suggested by\nMatthew Wilcox, migrate qrtr_tx_flow from radix_tree to xarray instead\nof fixing the radix_tree itself [1]. xarray properly handles cleanup of\ninternal nodes — xa_destroy() frees all internal xarray nodes when the\nqrtr_node is released, preventing the leak.\n\n[1] https://lore.kernel.org/all/20260225071623.41275-1-jiayuan.chen@linux.dev/T/"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"f2dd9aaf6e2861337f5835f877a5b2becaf4b015","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"4b75ff0aedd6ade1018ad4a3a9d8336794e36e42","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"0fda873092b541bb5a9b87d728a2429f863f8cfa","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"69402908e277dd164bf8d7c8fd0513c0fac28e9e","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"f2664bc4f0f356f17c2094587a2b3665e3867e44","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"5d2249eefaca59908fe3c264b8eca526424dcfbe","versionType":"git"},{"version":"5fdeb0d372ab33b4175043a2a4a1730239a217f1","status":"affected","lessThan":"2428083101f6883f979cceffa76cd8440751ffe6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/af_qrtr.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.6","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.134","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.81","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.22","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/qrtr/af_qrtr.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f2dd9aaf6e2861337f5835f877a5b2becaf4b015"},{"url":"https://git.kernel.org/stable/c/4b75ff0aedd6ade1018ad4a3a9d8336794e36e42"},{"url":"https://git.kernel.org/stable/c/ff134cc43972d7ddceff8cfd36cf6b9eaafc00b3"},{"url":"https://git.kernel.org/stable/c/0fda873092b541bb5a9b87d728a2429f863f8cfa"},{"url":"https://git.kernel.org/stable/c/69402908e277dd164bf8d7c8fd0513c0fac28e9e"},{"url":"https://git.kernel.org/stable/c/f2664bc4f0f356f17c2094587a2b3665e3867e44"},{"url":"https://git.kernel.org/stable/c/5d2249eefaca59908fe3c264b8eca526424dcfbe"},{"url":"https://git.kernel.org/stable/c/2428083101f6883f979cceffa76cd8440751ffe6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T22:16:34.530Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.134"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.12.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.18.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.19.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}