LiveActive security incident?Get immediate response
CVE Record

CVE-2026-3904: Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the G...

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue.  However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of the nscd client and the application that uses it. This implementation was backported to the 2.35 branch, making the nscd client in that branch vulnerable as well.  Subsequently, the fix for this issue was backported to all vulnerable branches in the GNU C Library repository. It is advised that distributions that may have cherry-picked the memcpy SSE2 optimization in their copy of the GNU C Library, also apply the fix to avoid the potential crash in the nscd client.

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-3904 can make some Linux applications crash when they use glibc name-service caching through nscd under high load. The issue affects availability, not data theft or data modification. Public sources do not show active exploitation, but outages are plausible on exposed x86_64 systems using vulnerable glibc builds.

Executive priority

Handle through normal patch management with priority for high-load Linux servers and operational technology environments. This is not a confirmed breach path, but it can interrupt services that depend on name-service lookups and nscd caching.

Technical view

The nscd client in GNU C Library may call memcmp on inputs concurrently modified by other threads or processes. With optimized x86_64 memcmp introduced in glibc 2.36 and backported to 2.35, this undefined behavior can crash the client application. The issue is classified as CWE-366 with CVSS 6.2, availability impact high.

Likely exposure

Most likely exposure is x86_64 Linux systems running glibc 2.35 or 2.36 variants using nscd-backed NSS caching. Distributions that cherry-picked the SSE2 memcmp optimization may also be exposed. Evidence in the bundle does not identify broad product lists beyond glibc and the Siemens advisory reference.

Exploitation context

The CVE is not listed as KEV, and the provided sources do not report active exploitation. The CVSS vector is local, low complexity, no privileges, no user interaction, with availability impact only. Treat it mainly as a local denial-of-service and reliability risk.

Researcher notes

The core weakness is a race around mutable comparison inputs in nscd client behavior, made crash-prone by optimized x86_64 memcmp. Sources say the fix was backported to vulnerable glibc branches. Product exposure outside glibc depends on vendor packaging and backport choices.

Mitigation direction

  • Apply vendor or distribution glibc updates containing the official fix.
  • Check GNU C Library advisory GLIBC-SA-2026-0004 for affected branch guidance.
  • Review distribution advisories if memcmp optimizations were cherry-picked.
  • Track Siemens SSA-082556 for product-specific remediation if applicable.
  • Restart affected services after glibc updates, following vendor guidance.

Validation and detection

  • Inventory x86_64 systems running glibc 2.35 or 2.36-derived builds.
  • Check whether nscd is installed, enabled, or used by critical services.
  • Confirm package changelogs include the referenced glibc fix commits.
  • Review crash logs for name-service lookup failures under high load.
  • Verify Siemens product exposure against SSA-082556 where relevant.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-366: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-3904 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.53.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.2Medium
CVSS 3.1 vector shape for CVE-2026-3904Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
The GNU C Libraryglibc2.35unaffected
Weakness

CWE details

CWE-366

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-366 · source CWE mapping

Race Condition within a Thread

Race Condition within a Thread represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs