All news with #race condition tag

🔒 Google’s Chrome team released version 151 (Windows, Mac and Linux) addressing 370 vulnerabilities, including seven critical flaws. The critical issues include several use after free bugs across Compositing, Views, Skia and Ozone, plus validation flaws in Dawn and ANGLE and a race condition in the Updater. These were reported between 18 May and 14 June 2026. The update also patches 71 high, 170 medium and 122 low severity issues, with researchers awarded $58,500 via the bug bounty.

🔒 Qualys TRU disclosed a decade-old race condition in the Linux XFS filesystem that allows an unprivileged local user to gain full root access on kernels 4.11+ when XFS reflink is enabled. The flaw, tracked as CVE-2026-64600 and dubbed RefluXFS, lets a race between concurrent writes corrupt the copy-on-write mechanism so the original file is modified directly on disk without kernel logs. Vendors merged a patch into upstream in July; affected organizations should apply vendor kernel updates and reboot to mitigate.

🛡️ A nine-year-old race condition in the Linux kernel's XFS filesystem, tracked as CVE-2026-64600 and dubbed RefluXFS by Qualys TRU, enables local attackers to overwrite protected files and gain root privileges. The flaw affects systems with reflink-enabled XFS on kernel v4.11+ and requires a directory writable by an unprivileged user plus a high-value target file. Exploitation is reliable, leaves no kernel logs, survives reboots, and bypasses common defenses because it operates at the filesystem allocation layer. Vendor-fixed kernels are available and immediate patching and rebooting are recommended.

🛡️ Microsoft released a security update addressing a privilege escalation bug in the Microsoft Malware Protection Engine, tracked as CVE-2026-50656. The issue, dubbed RoguePlanet, is a race condition that can allow an attacker to spawn a SYSTEM-level shell to run arbitrary code. The fix is included in engine version 1.1.26060.3008 and includes defense-in-depth hardening.

🛠️ Cloudflare’s Images service, built in Rust on Workers, encountered intermittent truncation of larger transformed images after a 2025 rearchitecture that connected Workers to Images via a local binding. The failure returned HTTP 200 with a shortened body and no logged errors, appearing only under production concurrency and reproducible as a timing-dependent race in the hyper HTTP library. Instrumentation, strace, and controlled reproductions identified premature shutdown calls from the Images service that left most response bytes in hyper’s internal buffer; a four-line change ultimately fixed the issue.

🔒 Rockwell Automation's FactoryTalk Historian Site Edition and related AVEVA PI Data Archive components contain vulnerabilities that can allow authentication bypass, denial of service, or crashes. Race conditions (CWE-362) and uncaught exceptions (CWE-248) are cited; repeated login requests may yield valid tokens. Vendors provide mitigations and patches; CISA urges network segmentation, restricted access, and defensive best practices.

🛡️ An anonymous researcher known as Chaotic Eclipse published a proof-of-concept for a Microsoft Defender zero-day dubbed RoguePlanet, a race-condition exploit that can yield SYSTEM-level shells on Windows 10 and 11 with June 2026 patches. The PoC is inconsistent across systems and currently fails on Windows Server due to ISO mounting restrictions. The disclosure follows prior Defender flaws from the same researcher and a public conflict with Microsoft over coordinated disclosure and account revocation.

🔒 Researchers disclosed a critical vulnerability in ChromaDB (CVE-2026-45829) that allows unauthenticated attackers to execute arbitrary code and access sensitive data on affected servers. The flaw is a race condition in the FastAPI-based API server that fetches and executes remote embedding model code before performing authentication checks. HiddenLayer says versions 1.0.0 through 1.5.8 are affected and many public instances remain vulnerable; they recommend using the Rust implementation and restricting network access until a patch is available.

⚠️Citrix has released a security bulletin for NetScaler ADC and NetScaler Gateway addressing two vulnerabilities: CVE-2026-3055 (critical out-of-bounds read, CVSS 9.3) and CVE-2026-4368 (race condition, CVSS 7.7). The issues affect customer-managed appliances with specific SAML IDP or Gateway/AAA configurations rather than default installs or Citrix-managed cloud instances. Cloud Software Group recommends immediate installation of the vendor-published patches and notes a temporary Global Deny List mitigation available for select 14.1 builds while upgrades are scheduled.

🔒 Microsoft released its November Patch Tuesday updates addressing over 60 CVEs, including an actively exploited Windows kernel zero-day (CVE-2025-62215). The flaw is a race-condition and double-free that can let low-privileged local attackers corrupt kernel memory and escalate to system privileges, though exploitation requires precise timing and local code execution. Administrators should also prioritise a critical GDI+ RCE (CVE-2025-60724, CVSS 9.8) that can be triggered by parsing specially crafted metafiles. Microsoft additionally issued an out-of-band update (KB5071959) to resolve Windows 10 Consumer ESU enrollment failures.