DEBIAN-CVE-2026-3904: glibc security update

DEBIAN-CVE-2026-3904, released March 11, 2026, fixes 1 CVE in glibc (version 2.36-9). None of them is reported as exploited. Patch Radar priority: Routine.

Routine

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

6.2

Base score, 0 to 10

Highest EPSS

0.0016

5th percentile

Fixed package versions

Product	Release	Fixed in
glibc	Debian 12.15 (bookworm)	2.36-9
glibc	Debian 13.5 (trixie)	2.36-9
glibc	Debian 14	2.36-9

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Routine	CVE-2026-3904	Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurrently modified by another thread, potentially resulting in spurious cache misses, which in itself is not a security issue. However in the GNU C Library version 2.36 an optimized implementation of memcmp was introduced for x86_64 which could crash when invoked with such undefined behaviour, turning this into a potential crash of the nscd client and the application that uses it. This implementation was backported to the 2.35 branch, making the nscd client in that branch vulnerable as well. Subsequently, the fix for this issue was backported to all vulnerable branches in the GNU C Library repository. It is	6.2	0.0016	None reported

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.