CVE-2026-4018

TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Analysis

AI-generated

Technical impact

An improper TOCTOU race condition in the TraceEvent system call’s trace commands can allow a local attacker with the PROCMGR_AID_TRACE capability to read restricted kernel data, alter memory contents, or cause a kernel crash. The flaw stems from a concurrent update of a classified as CWE‑367, and can compromise confidentiality, integrity, or availability of the QNX Neutrino system.

Affected Systems

The vulnerability affects BlackBerry’s QNX OS for Medical, QNX OS for Safety, and the QNX Software Development Platform. Specific version information is not listed. Event implementation is potentially impacted.

Risk and Exploitability

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is under 1 %, implying a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Attack requires local access with PROCMGR_AID_TRACE, making it an intra-system threat that could be leveraged by a privileged user or during a privilege escalation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest vendor patch or upgrade to a newer release of QNX OS for Medical, QNX OS for Safety or the QNX Software Development Platform that resolves the TOCTOU race condition.
  • Restrict the PROCMGR_AID_TRACE capability to only trusted processes, limiting the set of users who can issue trace commands.
  • Disable or eliminate the vulnerable trace commands if they are not required for your deployment.
  • Monitor kernel logs and trace activity for signs of abnormal behavior that could indicate an attempted exploitation.

Generated by OpenCVE AI on August 1, 2026 at 09:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Blackberry
Blackberry qnx Os For Medical
Blackberry qnx Os For Safety
Blackberry qnx Software Development Platform
Vendors & Products Blackberry
Blackberry qnx Os For Medical
Blackberry qnx Os For Safety
Blackberry qnx Software Development Platform
Type Values Removed Values Added
Description TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Title TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Weaknesses CWE-367
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

Sources

Status
PUBLISHED
Assigner
blackberry
Published
Updated
Jul 15, 2026, 2:01 PM
Reserved
Mar 11, 2026, 7:24 PM

View source JSON

Updated
Jul 15, 2026, 2:01 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 6:17 PM
Modified
Jul 15, 2026, 4:24 PM

View source JSON

No data.

Updated
Aug 1, 2026, 9:30 AM

JSON