CVE-2026-3904: 
NixOS vulnerability analysis and mitigation

CVE-2026-3904 is a race condition vulnerability in the GNU C Library (glibc) that can cause the nscd (Name Service Cache Daemon) client to crash on x86_64 systems under high load. The vulnerability affects glibc versions 2.35 and 2.36, where an optimized SSE2 memcmp implementation introduced for x86_64 crashes when invoked with inputs concurrently modified by other threads or processes. It was publicly disclosed on March 11, 2026, via the oss-security mailing list under advisory GLIBC-SA-2026-0004. The CVSS v3.1 base score is 6.2 (Medium) (Red Hat Advisory, oss-security).

The root cause is a race condition within a thread (CWE-366): the nscd client in glibc calls memcmp on memory buffers that may be concurrently modified by another thread or process, constituting undefined behavior. In glibc 2.36, an optimized x86_64 SSE2 memcmp implementation was introduced that is not tolerant of this undefined behavior and crashes rather than producing a spurious cache miss. This optimization was backported to the 2.35 branch, extending the vulnerability there as well. The attack vector is local (AV:L), requires no privileges or user interaction, and is triggered under high load conditions when NSS-backed functions (e.g., getpwnam, getaddrinfo) invoke the nscd caching path (Red Hat Bugzilla, glibc Bugzilla).

Successful exploitation results in a crash of the nscd client and any application that uses NSS-backed caching functions on affected x86_64 systems, constituting a Denial of Service (DoS). There is no impact on confidentiality or integrity — only availability is affected. The crash can disrupt name resolution and authentication services on systems relying on nscd for caching, potentially affecting multiple applications simultaneously (Red Hat Advisory, oss-security).

No confirmed exploit code or in-the-wild exploitation has been observed for CVE-2026-3904. The EPSS score is approximately 0.011% (0.000110), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and high-load conditions to trigger the race condition, significantly limiting practical exploitability (Feedly, glibc Bugzilla).

Update glibc to version 2.37 or later, which contains the fix for this issue. The fix has also been backported to the 2.35 and 2.36 branches in the upstream GNU C Library repository. Linux distributions that have cherry-picked the x86_64 SSE2 memcmp optimization should apply the corresponding patch from the glibc repository (commits 8804157ad9da39631703b92315460808eac86b0c and b712be52645282c706a5faa038242504feb06db5). As a temporary workaround, disabling nscd caching for affected NSS databases can prevent the vulnerable code path from being triggered (glibc commit, Red Hat Bugzilla).

The vulnerability was disclosed by Siddhesh Poyarekar via the oss-security mailing list on March 11, 2026, as part of the official glibc security advisory GLIBC-SA-2026-0004. Red Hat tracked the issue via Bugzilla (Bug 2446533) and assigned it medium severity. The Yocto Project security mailing list also discussed the issue, indicating awareness among embedded Linux distribution maintainers (oss-security, Red Hat Bugzilla, Yocto Security).