What Is a Race Condition in Cyber Security?

A race condition is a flaw in a concurrent code sequence that needs temporary exclusive access to a shared resource, where a timing window allows a second sequence to change that resource before the first one has finished with it. MITRE catalogs the class as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, and gives Race Condition as its alternate term.

Digital logic uses the same words for a race hazard, where the output of a circuit depends on which of two signals arrives first. Ordinary engineering talk stretches the term further, covering any nondeterministic behavior, including the test that fails once and passes on a rerun. Security usage narrows to what the CWE entry calls an interfering code sequence, which is either trusted, meaning it lives inside the product and can only be invoked indirectly, or untrusted, meaning the attacker writes it.

No Single Line Is to Blame in a Race Condition

MITRE describes a race condition as "effectively a property of a code sequence," where the sequence may be a function call, a handful of instructions, or a series of whole program invocations. Two guarantees fail at once, exclusivity and atomicity, while each statement involved can be correct when read on its own.

Assumptions about speed are where the weakness enters, which is why architecture and design sit alongside implementation among the introduction phases the entry records. A single increment of a counter looks atomic in source and comes apart at the instruction layer into a read, a computation, and a write. Any of the three can be interleaved with another thread operating on the same variable.

What TOCTOU Stands For and Why the Spelling Varies

The named subclass is CWE-367, where a product examines a resource before using it. Alteration during the interval leaves the earlier examination describing something no longer there.

The entry's title carries TOCTOU, with TOCTTOU and TOCCTOU recorded underneath as alternate terms. Expansion is given against the doubled-T form, Time Of Check To Time Of Use. The third spelling is one MITRE calls most likely a typo that keeps reappearing because influential documents carried it.

MITRE's worked example is a program installed setuid root that calls access to confirm the user may write a file, then calls fopen to open it. Both functions take a filename rather than an open handle. Nothing guarantees the name still points at the same file on disk when the second call runs. Swapping what the name resolves to during that interval is the entire attack, and the permission check is what supplied the false assurance.

Exploited Race Conditions in CISA's Catalog

CISA's Known Exploited Vulnerabilities catalog held 1,754 records in its 21 October 2026 version, twelve of them mapped to CWE-362 and five to CWE-367. Three of the seventeen also carry a memory-safety mapping, use-after-free twice and a heap overflow once. The timing flaw and the corruption it enables sit on one record.

CISA's vendor field names Linux on four of the records and Microsoft on five, with the remaining eight divided between Apple, Mozilla, Android, Google, Samsung and VMware. Every one of them sits in system software or a client application, and no web application appears anywhere on the list. The newest is a Linux kernel race dated September 2026. The class is still accumulating entries.

Inside a cluster, a kernel race reaches beyond the host it runs on, because every container on a node is served by one kernel. Isolation between workloads is itself a kernel feature. A flaw in the code enforcing it is reachable from any pod scheduled onto that node, which is part of what Kubernetes runtime security has to cover.

Why CVSS Scores a Race Condition Below Its Impact

Dirty COW is the reference case, recorded as CVE-2016-5195 and described by NVD as a race condition in the Linux kernel's copy-on-write handling that let local users gain privileges, exploited in the wild in October 2016. Its CVSS 3.1 base score is 7.0. The vector records complete impact on confidentiality, integrity, and availability, then holds the total down with a local attack vector and an attack complexity rated high.

What the complexity metric measures is timing difficulty, which says nothing about whether anyone will take the work on. CISA added this record to the exploited catalog in March 2022 with a remediation deadline three weeks later.

What Is a Race Condition and How Can It Be Prevented?

MITRE's guidance for CWE-362 opens with synchronization primitives wrapped around critical code only, so the cost in performance stays contained. Atomic operations on shared variables cover cases like the counter. Cutting the number of shared resources removes control flow complexity. It also removes the synchronization that complexity would have required.

Double-checked locking, CWE-609, is named in the guidance among the implementation errors that arise when developers try to avoid synchronization overhead. Unrestricted Externally Accessible Lock, CWE-412, sits alongside it, where the lock itself can be controlled from outside the intended sphere of control. Both are failures in the machinery meant to prevent the race. Thread-safe library functions round out the coding advice.

For the TOCTOU case, the first instruction is to stop performing a check before the use, on the grounds that the check cannot be made reliable and mostly supplies confidence it has not earned. Locking belongs before the check rather than after it, so the resource examined is the resource then used. Shortening the interval appears in the guidance as well, qualified by the statement that it fixes nothing and only makes an attack harder to land.

The attacker is under no obligation to accept that window as given. CWE-363 records that a product can be slowed down, by memory consumption among other means, until the gap between check and use is wide enough to work in. Repetition is the alternative – the same entry names, where in some situations the attack runs a large number of times until one attempt succeeds.

Every control in that guidance has to hold at the one moment two sequences meet. Raven watches the application as it runs, so an interleaving the design ruled out gets caught as it happens instead of being argued over in review. Book a demo to put it against your own workloads.

‍