CVE-2026-3904 (GCVE-0-2026-3904)

Vulnerability from cvelistv5 – Published: 2026-03-11 13:19 – Updated: 2026-03-11 15:56
VLAI?
Summary
Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue.  However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of the nscd client and the application that uses it. This implementation was backported to the 2.35 branch, making the nscd client in that branch vulnerable as well.  Subsequently, the fix for this issue was backported to all vulnerable branches in the GNU C Library repository. It is advised that distributions that may have cherry-picked the memcpy SSE2 optimization in their copy of the GNU C Library, also apply the fix to avoid the potential crash in the nscd client.
Severity ?
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-366 - Race condition within a thread
Assigner
References
Impacted products
Vendor Product Version
The GNU C Library glibc Affected: 2.35 , < 2.37 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-11T15:16:39.402Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/11/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-3904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T15:56:03.349329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T15:56:23.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "x86"
          ],
          "product": "glibc",
          "vendor": "The GNU C Library",
          "versions": [
            {
              "lessThan": "2.37",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eCalling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue.\u0026nbsp; However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well.\u0026nbsp; Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\u003cbr\u003e\n\u003cbr\u003eIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client.\u003c/div\u003e"
            }
          ],
          "value": "Calling NSS-backed functions that support caching via nscd may call the \nnscd client side code and in the GNU C Library version 2.36 under high \nload on x86_64 systems, the client may call memcmp on inputs that are \nconcurrently modified by other processes or threads and crash.\n\n\n\n\nThe nscd client in the GNU C Library uses the memcmp function with \ninputs that may be concurrently modified by another thread, potentially \nresulting in spurious cache misses, which in itself is not a security \nissue.\u00a0 However in the GNU C Library version 2.36 an optimized \nimplementation of memcmp was introduced for x86_64 which could crash \nwhen invoked with such undefined behaviour, turning this into a \npotential crash of the nscd client and the application that uses it. \nThis implementation was backported to the 2.35 branch, making the nscd \nclient in that branch vulnerable as well.\u00a0 Subsequently, the fix for \nthis issue was backported to all vulnerable branches in the GNU C \nLibrary repository.\n\n\nIt is advised that distributions that may have cherry-picked the memcpy \nSSE2 optimization in their copy of the GNU C Library, also apply the fix \nto avoid the potential crash in the nscd client."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-366",
              "description": "CWE-366 Race condition within a thread",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T13:19:09.741Z",
        "orgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
        "shortName": "glibc"
      },
      "references": [
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0004;hb=HEAD"
        },
        {
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29863"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=8804157ad9da39631703b92315460808eac86b0c"
        },
        {
          "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=b712be52645282c706a5faa038242504feb06db5"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3ff69d7a-14f2-4f67-a097-88dee7810d18",
    "assignerShortName": "glibc",
    "cveId": "CVE-2026-3904",
    "datePublished": "2026-03-11T13:19:09.741Z",
    "dateReserved": "2026-03-10T19:52:49.054Z",
    "dateUpdated": "2026-03-11T15:56:23.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3904\",\"sourceIdentifier\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\",\"published\":\"2026-03-11T14:16:30.113\",\"lastModified\":\"2026-03-12T21:08:22.643\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Calling NSS-backed functions that support caching via nscd may call the \\nnscd client side code and in the GNU C Library version 2.36 under high \\nload on x86_64 systems, the client may call memcmp on inputs that are \\nconcurrently modified by other processes or threads and crash.\\n\\n\\n\\n\\nThe nscd client in the GNU C Library uses the memcmp function with \\ninputs that may be concurrently modified by another thread, potentially \\nresulting in spurious cache misses, which in itself is not a security \\nissue.\u00a0 However in the GNU C Library version 2.36 an optimized \\nimplementation of memcmp was introduced for x86_64 which could crash \\nwhen invoked with such undefined behaviour, turning this into a \\npotential crash of the nscd client and the application that uses it. \\nThis implementation was backported to the 2.35 branch, making the nscd \\nclient in that branch vulnerable as well.\u00a0 Subsequently, the fix for \\nthis issue was backported to all vulnerable branches in the GNU C \\nLibrary repository.\\n\\n\\nIt is advised that distributions that may have cherry-picked the memcpy \\nSSE2 optimization in their copy of the GNU C Library, also apply the fix \\nto avoid the potential crash in the nscd client.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-366\"}]}],\"references\":[{\"url\":\"https://sourceware.org/bugzilla/show_bug.cgi?id=29863\",\"source\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\"},{\"url\":\"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0004;hb=HEAD\",\"source\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\"},{\"url\":\"https://sourceware.org/git/?p=glibc.git;a=commit;h=8804157ad9da39631703b92315460808eac86b0c\",\"source\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\"},{\"url\":\"https://sourceware.org/git/?p=glibc.git;a=commit;h=b712be52645282c706a5faa038242504feb06db5\",\"source\":\"3ff69d7a-14f2-4f67-a097-88dee7810d18\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/03/11/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/03/11/5\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-11T15:16:39.402Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3904\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-11T15:56:03.349329Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-11T15:54:25.882Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"The GNU C Library\", \"product\": \"glibc\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.35\", \"lessThan\": \"2.37\", \"versionType\": \"custom\"}], \"platforms\": [\"x86\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0004;hb=HEAD\"}, {\"url\": \"https://sourceware.org/bugzilla/show_bug.cgi?id=29863\"}, {\"url\": \"https://sourceware.org/git/?p=glibc.git;a=commit;h=8804157ad9da39631703b92315460808eac86b0c\"}, {\"url\": \"https://sourceware.org/git/?p=glibc.git;a=commit;h=b712be52645282c706a5faa038242504feb06db5\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Calling NSS-backed functions that support caching via nscd may call the \\nnscd client side code and in the GNU C Library version 2.36 under high \\nload on x86_64 systems, the client may call memcmp on inputs that are \\nconcurrently modified by other processes or threads and crash.\\n\\n\\n\\n\\nThe nscd client in the GNU C Library uses the memcmp function with \\ninputs that may be concurrently modified by another thread, potentially \\nresulting in spurious cache misses, which in itself is not a security \\nissue.\\u00a0 However in the GNU C Library version 2.36 an optimized \\nimplementation of memcmp was introduced for x86_64 which could crash \\nwhen invoked with such undefined behaviour, turning this into a \\npotential crash of the nscd client and the application that uses it. \\nThis implementation was backported to the 2.35 branch, making the nscd \\nclient in that branch vulnerable as well.\\u00a0 Subsequently, the fix for \\nthis issue was backported to all vulnerable branches in the GNU C \\nLibrary repository.\\n\\n\\nIt is advised that distributions that may have cherry-picked the memcpy \\nSSE2 optimization in their copy of the GNU C Library, also apply the fix \\nto avoid the potential crash in the nscd client.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eCalling NSS-backed functions that support caching via nscd may call the \\nnscd client side code and in the GNU C Library version 2.36 under high \\nload on x86_64 systems, the client may call memcmp on inputs that are \\nconcurrently modified by other processes or threads and crash.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe nscd client in the GNU C Library uses the memcmp function with \\ninputs that may be concurrently modified by another thread, potentially \\nresulting in spurious cache misses, which in itself is not a security \\nissue.\u0026nbsp; However in the GNU C Library version 2.36 an optimized \\nimplementation of memcmp was introduced for x86_64 which could crash \\nwhen invoked with such undefined behaviour, turning this into a \\npotential crash of the nscd client and the application that uses it. \\nThis implementation was backported to the 2.35 branch, making the nscd \\nclient in that branch vulnerable as well.\u0026nbsp; Subsequently, the fix for \\nthis issue was backported to all vulnerable branches in the GNU C \\nLibrary repository.\u003cbr\u003e\\n\u003cbr\u003eIt is advised that distributions that may have cherry-picked the memcpy \\nSSE2 optimization in their copy of the GNU C Library, also apply the fix \\nto avoid the potential crash in the nscd client.\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-366\", \"description\": \"CWE-366 Race condition within a thread\"}]}], \"providerMetadata\": {\"orgId\": \"3ff69d7a-14f2-4f67-a097-88dee7810d18\", \"shortName\": \"glibc\", \"dateUpdated\": \"2026-03-11T13:19:09.741Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3904\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-11T15:56:23.027Z\", \"dateReserved\": \"2026-03-10T19:52:49.054Z\", \"assignerOrgId\": \"3ff69d7a-14f2-4f67-a097-88dee7810d18\", \"datePublished\": \"2026-03-11T13:19:09.741Z\", \"assignerShortName\": \"glibc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.