Junglewise Threat Intelligence

CVE-2026-3904: GNU glibc race condition crash in nscd client via memcmp

CVE-2026-3904 · Severity: medium · CVSS 6.2 · Published 2026-03-11

Technologies: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Gnu Glibc. Vendors: Siemens, Gnu.

Executive brief

A vulnerability in the standard C library (glibc) used by many Linux-based systems can cause applications to crash under high load. This occurs when the system's name service cache (nscd) attempts to compare data that is being simultaneously modified by another process. An exploit could lead to a denial-of-service condition, impacting the availability of critical services and applications on the affected system.

Technical details

A race condition exists in the nscd (Name Service Cache Daemon) client-side code within glibc. When NSS-backed functions are called under high load on x86_64 systems, the client may invoke an optimized SSE2 implementation of memcmp on memory regions that are being concurrently modified by other threads or processes. While such concurrent modification is generally undefined behavior, the specific SSE2 optimization introduced in glibc 2.36 (and backported to 2.35) fails to handle the resulting inconsistent state, leading to a segmentation fault (SIGSEGV). This results in a crash of the nscd client and the calling application. The issue has been patched in glibc versions 2.37, 2.36-84, and 2.35-230.

Affected products

  • GNU glibc 2.35, 2.36
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 before V3.1.6

Timeline

  • 2022-12-07: disclosed: Bug reported to GNU C Library bugzilla
  • 2026-03-11: advisory: GLIBC-SA-2026-0004 published
  • 2026-03-11: patched: Fixes backported to vulnerable branches

References

Related threats