CVE-2026-38636: relibc seekdir() Function DoS Vulnerability

CVE-2026-38636 Overview

CVE-2026-38636 is a denial-of-service vulnerability in the seekdir() function located in /dirent/mod.rs of relibc, the C library implementation used by the Redox operating system. The flaw exists in commit 61f42d and allows a remote attacker to trigger a denial-of-service condition through crafted input. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption. No authentication or user interaction is required to trigger the condition, and the impact is limited to availability.

Critical Impact
Attackers can crash or hang processes linked against the vulnerable relibc build by supplying malicious input to code paths that call seekdir(), disrupting service availability.

Affected Products

relibc (Redox OS C library) at commit 61f42d
Applications and services on Redox OS that link against the vulnerable relibc build
Downstream projects vendoring the affected relibc commit

Discovery Timeline

2026-08-28 - CVE-2026-38636 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38636

Vulnerability Analysis

The vulnerability resides in the seekdir() implementation within /dirent/mod.rs of relibc. The seekdir() function is a POSIX directory-stream primitive used to reposition the internal cursor of a DIR stream to an offset previously returned by telldir(). When the function receives a crafted offset or state value, it enters a condition that exhausts resources or panics, terminating the calling process.

The issue is tracked in the upstream project as GitLab Issue #260 with a fix proposed in Merge Request #980. A public proof-of-concept exists in the Marsman1996 pocs repository, confirming that the trigger is reachable through normal library entry points without special privileges.

Root Cause

The root cause is insufficient validation of input parameters passed to seekdir(), matching the [CWE-400] Uncontrolled Resource Consumption pattern. The function does not adequately bound or sanitize the requested seek offset against the directory stream's internal state. A malformed value forces the routine into an expensive or non-terminating path, consuming CPU or memory until the process is killed.

Attack Vector

Exploitation requires that an attacker influence the offset argument supplied to seekdir() in a program built against relibc. In network-facing services that parse untrusted input and drive directory traversal state from it, the attacker can remotely deliver the malicious value. Successful exploitation produces a denial-of-service condition on the affected process, with no confidentiality or integrity impact.

Refer to the GitHub PoC for CVE-2026-38636 for the reproducer used by the reporter, and to GitLab Issue #260 for the upstream triage discussion.

Detection Methods for CVE-2026-38636

Indicators of Compromise

Repeated abrupt termination or hang of Redox processes that iterate directories under attacker-controlled input.
Spikes in CPU or memory usage in services calling seekdir() shortly before a crash.
Log entries showing panics or aborts originating from relibcdirent/mod.rs.

Detection Strategies

Audit application source and dependencies for direct or indirect calls to seekdir() that consume untrusted offsets.
Compare the deployed relibc revision against commit 61f42d and flag builds at or before the fix in Merge Request #980.
Run the published proof-of-concept in a controlled lab against staging builds to confirm exposure.

Monitoring Recommendations

Alert on unexpected process restarts or watchdog resets for services built on relibc.
Track resource-consumption anomalies (CPU saturation, memory growth) correlated with directory-listing endpoints.
Forward crash dumps and panic traces to a central log store and search for frames referencing dirent/mod.rs.

How to Mitigate CVE-2026-38636

Immediate Actions Required

Inventory all builds that link against relibc and identify any at commit 61f42d or earlier.
Rebuild affected binaries against a relibc revision that includes the fix from GitLab Merge Request #980.
Restrict network exposure of services that drive seekdir() offsets from untrusted input until patched.

Patch Information

The upstream fix is tracked in GitLab Merge Request #980 against GitLab Issue #260. Consumers should pull relibc past the merge commit and rebuild dependent projects. Verify the fix by rerunning the reporter's proof-of-concept from the Marsman1996 pocs repository.

Workarounds

Validate and clamp offset values obtained from external sources before passing them to seekdir().
Wrap directory-iteration code paths in resource limits (ulimit, cgroup CPU and memory caps) to contain the impact of triggered denial-of-service.
Apply rate limiting and input-size caps at network boundaries feeding directory-traversal logic.

bash

# Configuration example: constrain resources for services linked against vulnerable relibc
systemd-run --scope \
  -p CPUQuota=50% \
  -p MemoryMax=256M \
  -p TasksMax=128 \
  /usr/local/bin/redox-service