CVE-2026-100290: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-100290 is a double-free and use-after-free vulnerability in the GNU C Library (glibc) affecting the regcomp and regexec regex functions. It impacts glibc versions 2.3 through 2.44 across all supported architectures and ABIs. The vulnerability was published on November 11, 2026, and is tracked under GHSA-qvhh-2rc2-h32w. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is a double-free memory corruption (CWE-415) combined with use-after-free (CWE-416) in glibc's POSIX regex engine. Three specific code paths are affected: re_dfa_add_node (NFA node table) and build_range_exp (bracket ranges) each grow multiple arrays via consecutive realloc calls, storing new pointers only after all calls succeed — when a later realloc fails, the pattern buffer retains stale pointers to already-freed blocks, which are then freed again during error cleanup. In regexec, the back-reference cache function match_ctx_add_entry frees its array on a failed realloc but retains the pointer, which is freed a second time on the error path. Exploitation requires the system to be under memory pressure so that a specific allocation fails; the attacker does not need to supply a specially crafted regex, as patterns large enough to trigger array growth are common (GitHub Advisory, glibc Bugzilla #34991).

The primary impact is a denial of service: successful exploitation causes a crash of any process that uses glibc's regcomp or regexec functions. Because the attacker has little control over which specific allocation fails, arbitrary code execution is considered unlikely; the expected outcome is process termination. The vulnerability affects all architectures and ABIs supported by glibc, meaning the potential scope is extremely broad given glibc's ubiquity across Linux systems (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. Exploitation is constrained by the requirement that the target system be under memory pressure at the time of the regex operation, and the attacker has minimal control over which allocation fails. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, oss-sec).

1. Identify target: Locate a network-accessible service or application that uses glibc's regcomp/regexec functions and accepts user-supplied regex patterns or subject strings (e.g., log analyzers, web application firewalls, search services).
2. Induce memory pressure: Cause the target system to operate under memory pressure — for example, by submitting many concurrent requests or exploiting other resource exhaustion vectors — so that heap allocations are likely to fail.
3. Submit triggering input: Supply a regular expression pattern or subject string large enough to cause re_dfa_add_node, build_range_exp, or match_ctx_add_entry to attempt array reallocation. Patterns with large character classes (bracket expressions) or complex back-references are candidates.
4. Trigger allocation failure: Under memory pressure, a subsequent realloc call within the regex engine fails, leaving stale pointers in the pattern buffer or match context.
5. Crash the process: The error cleanup path frees the already-freed heap block, causing a double-free that results in process termination (denial of service) (GitHub Advisory, glibc Bugzilla #34991).

• Logs: Unexpected process crashes or segmentation faults in applications using glibc regex functions; kernel logs (dmesg) showing heap corruption errors or double-free detection messages (e.g., free(): double free detected).
• Process: Abnormal termination of services that perform regex matching (e.g., grep, web servers, security tools) under high memory load conditions.
• System: Repeated out-of-memory (OOM) events or memory pressure alerts coinciding with regex-processing workloads; core dump files generated by affected processes.

Upgrade glibc to a version beyond 2.44 once a patched release is available from the GNU C Library project (tracked under GLIBC-SA-2026-0028). In the interim, monitor and limit system memory pressure using resource controls (e.g., ulimit, cgroups) on processes that perform regex operations to reduce the likelihood of triggering the vulnerable allocation failure path. Restrict untrusted input to regex-processing services where possible (glibc Advisory, GitHub Advisory).

The vulnerability was disclosed via the oss-security mailing list and the glibc project's own advisory system (GLIBC-SA-2026-0028). Given the low CVSS score and the constrained exploitation conditions (memory pressure required), community reaction has been measured, with no significant amplification observed on social media or major security news outlets as of the disclosure date (oss-sec).