CVE-2026-3904

A flaw was found in glibc. When calling NSS-backed functions that support caching via nscd, the nscd client under high load on x86_64 systems may call the memcmp function on inputs that are concurrently modified by other processes or threads, causing a crash and resulting in a denial of service.

This issue is only exploitable via applications using NSS-backed functions that support caching via nscd under a high load on x86_64 systems. It depends on a race condition on inputs that are concurrently modified by other processes or threads during memory access, increasing the complexity of exploitation. Also, this flaw can only cause an application crash, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.