CVE-2026-38636

relibc, the Rust-written C standard library developed by the Redox OS project, contains a flaw in its seekdir() function (/dirent/mod.rs) that permits uncontrolled resource consumption (CWE-400). An attacker who can get crafted input into directory-stream operations, such as a crafted directory position reaching seekdir(), can exhaust resources or crash the affected process. The impact is availability only (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning a remote, unauthenticated attacker with no user interaction can cause a denial of service, with no confidentiality or integrity impact. Affected are anyone building against or running software compiled with the affected relibc commit (61f42d) — in practice primarily Redox OS users and developers, since relibc sees little use outside that ecosystem. There is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS assigns only a 0.4% probability of exploitation within 30 days, so no active exploitation is currently known.

What to do: Track the relibc repository (github.com/redox-os/relibc) for a fixed commit or release and update past commit 61f42d, then rebuild any software linked against it. Until a fix is available, avoid exposing directory-stream operations (opendir/readdir/seekdir) to untrusted, network-controlled input, and verify your build manifests or lockfiles to confirm whether the affected commit is in use.