CVE-2026-26201

Date: February 18, 2026

Summary Multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger "fatal error: concurrent map read and map write", causing C2 process crash (availability loss). Vulnerable Component(with code examples) Operator relay map had mixed access patterns (iteration and mutation without a single lock policy): // vulnerable pattern (operator session map) for sessionID, op := range OPERATORS { // iteration path ... } // concurrent mutation path elsewhere OPERATORS[operatorSession] = &operator_t{...} delete(OPERATORS, operatorSession) Port-forwarding session map had read/write paths guarded inconsistently: // vulnerable pattern (port forward map) if sess, ok := PortFwds[id]; ok { // read path ... } PortFwds[id] = newSession // write path delete(PortFwds, id) // delete path FTP stream map similarly mixed concurrent iteration with mutation: // vulnerable pattern (FTP stream map) for token, stream := range FTPStreams { // iteration path ... } FTPStreams[token] = stream // write path delete(FTPStreams, token) // delete path Attack Vector 1. Attacker (or stress traffic in authenticated flows) triggers high concurrency in normal control paths. 2. Operator sessions connect/disconnect while message forwarding and file-transfer workflows are active. 3. Concurrent read/write hits shared maps. 4. Go runtime panics with concurrent map read/write error. 5. C2 component exits, producing denial of service. Proof of Concept 6. Start C2 server with active operator session(s) in a lab environment. 7. Generate rapid operator session churn (connect/disconnect loops). 8. Simultaneously drive agent message tunnel traffic and/or file transfer activity. 9. Observe crash signature in logs: "fatal error: concurrent map read and map write". 10. Optional: run with race detector in dev build to confirm race locations. Impact - C2 service interruption due to process panic/crash. - Operational instability under load or deliberate churn. - Repeated crash-restart cycles can degrade command reliability and incident response workflows.