Executive brief
A vulnerability exists in relibc, a core C library used by the Redox operating system. An attacker can cause a program to crash by providing unexpected input to a specific system function. This results in a denial-of-service condition where the affected application stops functioning, potentially impacting system stability or service availability.
Technical details
A reachable 'expect' panic exists in the pthread_rwlockattr_setpshared() function within relibc (specifically in src/header/pthread/rwlock.rs). The root cause is the use of .expect() on a Result/Option returned by Pshared::from_raw() when an invalid pshared value (neither PTHREAD_PROCESS_PRIVATE nor PTHREAD_PROCESS_SHARED) is provided. A local attacker can trigger this panic by executing a program that passes an unsupported integer to the function, leading to an immediate process crash (SIGILL/Invalid Opcode). A fix has been proposed in merge request !987 to return EINVAL instead of panicking.
Affected products
- Redox OS relibc commit 61f42d6b93adc552a9e8b6f207fca907e8ca8be2
Timeline
- 2026-02-10: patched: Merge request !987 submitted to handle invalid pshared values.
- 2026-06-25: disclosed: CVE-2026-38637 published.