CVE-2026-4018: TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-07-15
Weakness: CWE-367

Description

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Affected products

BlackBerry Ltd QNX OS for Safety: through 2.2.8; through 2.1.5; through 2.0.3; cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*, cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*, cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*
BlackBerry Ltd QNX Software Development Platform: 7.1, cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*, 7.0, cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*
BlackBerry Ltd. QNX OS for Medical: through 2.0.2; cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*

References

https://support.blackberry.com/pkb/s/article/141213

Get alerted when CVE-2026-4018 or the next vulnerability affects your stack