# CVE-2026-3904: Calling NSS-backed functions that support caching via nscd may call the  nscd client side code and in the GNU C Library version 2.36 under high  load on x86_64 systems, the client may call memcmp on inputs that are  concurrently modified by other processes or threads and crash.     The nscd client in the GNU C Library uses the memcmp function with  inputs that may be concurrently modified by another thread, potentially  resulting in spurious cache misses, which in itself is not a security  issue.  However in the GNU C Library version 2.36 an optimized  implementation of memcmp was introduced for x86_64 which could crash  when invoked with such undefined behaviour, turning this into a  potential crash of the nscd client and the application that uses it.  This implementation was backported to the 2.35 branch, making the nscd  client in that branch vulnerable as well.  Subsequently, the fix for  this issue was backported to all vulnerable branches in the GNU C  Library repository.   It is

CVE-2026-3904 is fixed in glibc on 1 platform, first by DEBIAN-CVE-2026-3904, released March 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-3904
- Priority: Routine
- CVSS: 6.2 (Moderate)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 11, 2026
- Weakness: Race Condition within a Thread
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3904

## Description

Calling NSS-backed functions that support caching via nscd may call the  nscd client side code and in the GNU C Library version 2.36 under high  load on x86_64 systems, the client may call memcmp on inputs that are  concurrently modified by other processes or threads and crash.     The nscd client in the GNU C Library uses the memcmp function with  inputs that may be concurrently modified by another thread, potentially  resulting in spurious cache misses, which in itself is not a security  issue.  However in the GNU C Library version 2.36 an optimized  implementation of memcmp was introduced for x86_64 which could crash  when invoked with such undefined behaviour, turning this into a  potential crash of the nscd client and the application that uses it.  This implementation was backported to the 2.35 branch, making the nscd  client in that branch vulnerable as well.  Subsequently, the fix for  this issue was backported to all vulnerable branches in the GNU C  Library repository.   It is advised that distributions that may have cherry-picked the memcpy  SSE2 optimization in their copy of the GNU C Library, also apply the fix  to avoid the potential crash in the nscd client.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | glibc Debian 12.15 (bookworm) | 2.36-9 | [DEBIAN-CVE-2026-3904](https://patchblox.com/security/data/fix/linux/debian-cve-2026-3904.md) | Mar 11, 2026 |
| Linux | glibc Debian 13.5 (trixie) | 2.36-9 | [DEBIAN-CVE-2026-3904](https://patchblox.com/security/data/fix/linux/debian-cve-2026-3904.md) | Mar 11, 2026 |
| Linux | glibc Debian 14 | 2.36-9 | [DEBIAN-CVE-2026-3904](https://patchblox.com/security/data/fix/linux/debian-cve-2026-3904.md) | Mar 11, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.