CVE-2026-11791: 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()
A flaw was found in 389 Directory Server. During schema reload, the attrsyntaxswapht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).
Other sources
A use-after-free vulnerability exists in 389 Directory Server's schema reload mechanism. The attrsyntaxswapht() function (attrsyntax.c:1639-1665) frees all attribute syntax info nodes unconditionally via attrsyntaxfree(), bypassing the refcount-based deferred deletion pattern used by attrsyntaxdeletenolock() in the same file.
When an administrator triggers a schema reload (dsconf schema reload or cn=schema,cn=config modification) while concurrent LDAP query traffic is active, query threads that hold asyntaxinfo references after releasing the read lock access freed memory. Subsequent access or attrsyntaxreturn() on the dangling pointer causes use-after-free or double-free, crashing ns-slapd with SIGSEGV.
The race window is narrow (nanoseconds to low microseconds). GDB-controlled reproduction confirmed UAF with MALLOCPERTURB=170 and double-free crash. Stress testing (380 reloads + 12 query threads, 80s) did not trigger a natural crash.
Contributing factor: slapiattrisdnsyntaxtype() leaks asirefcnt by calling attrsyntaxgetbyname() without attrsyntaxreturn(), increasing the probability of nodes with outstanding references when swapht frees them.
Introduced with the dynamic schema reload feature. Present in all shipped 389-ds-base versions with schema reload support. CVE-2025-14905 fix patched schema.c only; attrsyntax.c untouched.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
389-ds-baseto a version that resolves this vulnerability.Patch CVE-2025-14905 - Compensating control
Mitigate the race by avoiding triggering schema reload (via dsconf schema reload or cn=schema,cn=config modification) while concurrent LDAP query traffic is active.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11791?
CVE-2026-11791 has a medium severity rating of 5.
How do I fix CVE-2026-11791?
To fix CVE-2026-11791, ensure you update to the latest version of Red Hat 389 Directory Server that includes the security patch.
What systems are affected by CVE-2026-11791?
CVE-2026-11791 affects Red Hat Enterprise Linux and Red Hat 389 Directory Server.
What does the vulnerability CVE-2026-11791 exploit?
CVE-2026-11791 exploits a use-after-free flaw during schema reload via the attr_syntax_swap_ht() function.
What could be the impact of CVE-2026-11791?
The impact of CVE-2026-11791 could lead to a denial of service condition in the affected systems.