CVE-2026-4018

Summary

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Affected Software

VendorProductVersion RangeStatus
BlackBerry LtdQNX Software Development Platform7.1affected
BlackBerry LtdQNX Software Development Platformcpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*affected
BlackBerry LtdQNX Software Development Platform7.0affected
BlackBerry LtdQNX Software Development Platformcpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*affected
BlackBerry LtdQNX OS for Safety2.2.8 and earlieraffected
BlackBerry LtdQNX OS for Safetycpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*affected
BlackBerry LtdQNX OS for Safety2.1.5 and earlieraffected
BlackBerry LtdQNX OS for Safetycpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*affected
BlackBerry LtdQNX OS for Safety2.0.3 and earlieraffected
BlackBerry LtdQNX OS for Safetycpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*affected
BlackBerry Ltd.QNX OS for Medical2.0.2 and earlieraffected
BlackBerry Ltd.QNX OS for Medicalcpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*affected

Weaknesses

  • CWE-367: CWE-367 Time-of-check time-of-use (TOCTOU) race condition

References