CVE-2026-38641 Details
Description
An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.
A denial-of-service vulnerability has been identified in the Redox operating system's relibc library, specifically in commit 61f42d. The issue arises in the DSO::mmap_and_copy function, where attackers can cause a panic by loading a crafted shared library that lacks a valid PT_LOAD segment. This vulnerability is triggered when a program calls dlopen() with an invalid binary, leading to a reachable unwrap panic.
Users can update to the latest version of relibc, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 26, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.redox-os.org/redox-os/relibc/-/work_items/263 | CISA-ADP | Issue TrackingPermission RequiredVendor |
| https://github.com/Marsman1996/pocs/tree/master/redox/CVE-2026-38641 | [email protected] | ExploitTechnical Description |
| https://gitlab.redox-os.org/redox-os/relibc/-/issues/263 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://gitlab.redox-os.org/redox-os/relibc/-/merge_requests/1046 | [email protected] | Permission RequiredVendor |
| https://gitlab.redox-os.org/redox-os/relibc/-/work_items/263 | [email protected] | Issue TrackingPermission RequiredVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-404 | Improper Resource Shutdown or Release | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| relibc | 61f42d6b93adc552a9e8b6f207fca907e8ca8be2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |