CVE-2026-3904: GNU C Library nscd DoS Vulnerability

CVE-2026-3904 Overview

CVE-2026-3904 is a race condition vulnerability in the GNU C Library (glibc) affecting the Name Service Cache Daemon (nscd) client. The vulnerability occurs when NSS-backed functions that support caching via nscd call the nscd client side code under high load conditions on x86_64 systems. The client may invoke memcmp on inputs that are concurrently modified by other processes or threads, resulting in application crashes.

The root cause stems from an optimized implementation of memcmp introduced in glibc version 2.36 for x86_64 architectures. This SSE2-optimized implementation crashes when invoked with undefined behavior caused by concurrent memory modifications, transforming what was previously a benign spurious cache miss scenario into a denial of service condition. The optimization was also backported to the 2.35 branch, extending the vulnerability's reach.

Critical Impact

Applications relying on nscd for name service caching on x86_64 Linux systems may experience unexpected crashes under high load conditions, potentially causing service disruptions in multi-threaded environments.

Affected Products

• GNU C Library (glibc) version 2.36
• GNU C Library (glibc) version 2.35 (with backported SSE2 memcmp optimization)
• Linux distributions that cherry-picked the memcpy SSE2 optimization

Discovery Timeline

• March 11, 2026 - CVE-2026-3904 published to NVD
• March 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3904

Vulnerability Analysis

This vulnerability is classified under CWE-366 (Race Condition within a Thread), representing a concurrency flaw in the nscd client implementation. The issue manifests when multiple threads or processes interact with the name service cache simultaneously.

The nscd client uses memcmp to compare cached data, but the memory regions being compared may be modified concurrently by other threads. While this concurrent access previously resulted only in spurious cache misses (a performance issue rather than a security concern), the introduction of the SSE2-optimized memcmp implementation changed the behavior fundamentally. The optimized code assumes memory stability during comparison operations, and when this assumption is violated, the function crashes rather than returning incorrect results.

The attack vector is local, requiring no privileges or user interaction. An attacker with local access could potentially trigger high-load conditions to exploit this race condition and crash applications depending on nscd, leading to denial of service.

Root Cause

The root cause is a race condition in the nscd client code combined with an SSE2-optimized memcmp implementation that does not handle concurrent memory modifications gracefully. The optimized memcmp introduced in glibc 2.36 relies on memory consistency guarantees that are violated when the nscd client's input buffers are modified by concurrent threads during comparison operations.

Attack Vector

The vulnerability requires local access to the system. An attacker can exploit this by:

1. Running applications that utilize NSS-backed functions with nscd caching enabled
2. Creating high-load conditions on x86_64 systems to increase the likelihood of concurrent memory access
3. Triggering repeated nscd client calls that invoke the vulnerable memcmp implementation

The race condition window is widened under high system load, making exploitation more reliable in stressed environments. Since this affects the nscd client rather than the daemon itself, any application using name service lookups (DNS resolution, user authentication, etc.) could be impacted.

Detection Methods for CVE-2026-3904

Indicators of Compromise

• Unexpected application crashes with segmentation faults in memcmp or related memory comparison functions
• Crash dumps showing stack traces involving nscd client code paths
• Increased frequency of application crashes under high load conditions on x86_64 systems
• System logs showing repeated restarts of services that perform name service lookups

Detection Strategies

• Monitor for segmentation fault signals (SIGSEGV) in applications using nscd
• Implement crash dump analysis to identify memcmp-related failures in glibc
• Track glibc version across systems to identify vulnerable installations (versions 2.35 and 2.36 with SSE2 optimization)
• Use system auditing to correlate application crashes with high CPU load events

Monitoring Recommendations

• Configure application monitoring to alert on abnormal crash rates
• Implement centralized logging to correlate nscd-related crashes across multiple systems
• Monitor system load metrics to identify conditions that may trigger the vulnerability
• Deploy endpoint detection solutions capable of identifying race condition exploitation patterns

How to Mitigate CVE-2026-3904

Immediate Actions Required

• Update glibc to a patched version that includes the fix for the race condition
• For systems where immediate patching is not possible, consider temporarily disabling nscd caching
• Review Linux distribution security advisories for vendor-specific patches
• Prioritize patching on x86_64 systems running glibc 2.35 or 2.36 under high-load conditions

Patch Information

The GNU C Library project has released fixes for this vulnerability. The relevant commits are available in the glibc repository:

• GLIBC Commit Details #8804157 - Primary fix
• GLIBC Commit Details #b712be5 - Additional fix

The fix has been backported to all vulnerable branches in the GNU C Library repository. Distributions that may have cherry-picked the memcpy SSE2 optimization should also apply the fix to avoid potential crashes. For additional details, see the GLIBC Security Advisory 2026-0004 and the Sourceware Bug Report #29863.

Workarounds

• Disable nscd service temporarily using systemctl stop nscd && systemctl disable nscd
• Configure applications to bypass nscd caching by modifying /etc/nsswitch.conf
• Reduce system load to minimize the likelihood of triggering the race condition
• Consider using alternative caching mechanisms such as sssd where applicable

# Temporary workaround: Disable nscd service
systemctl stop nscd
systemctl disable nscd

# Alternative: Modify nsswitch.conf to bypass nscd
# Backup original configuration
cp /etc/nsswitch.conf /etc/nsswitch.conf.backup

# Edit nsswitch.conf to remove [NOTFOUND=return] hints
# or configure applications to not use caching