Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2026-4018

TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
blackberry

Description

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

BlackBerry Ltd QNX Software Development Platform

Default version status: unaffected

  • 7.1affected
  • cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*affected
  • 7.0affected
  • cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*affected

BlackBerry Ltd QNX OS for Safety

Default version status: unaffected

  • 2.2.8 and earlieraffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*affected
  • 2.1.5 and earlieraffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*affected
  • 2.0.3 and earlieraffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*affected

BlackBerry Ltd. QNX OS for Medical

Default version status: unaffected

  • 2.0.2 and earlieraffected
  • cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*affected

References