A use-after-free vulnerability exists in Red Hat Directory Server 11 within the attr_syntax_swap_ht() function during schema reload. This function unconditionally frees attribute syntax information nodes, bypassing the reference count-based deferred deletion mechanism used elsewhere. If an administrator triggers a schema reload while LDAP query traffic is active, worker threads may access memory that has already been freed, causing use-after-free or double-free conditions and leading to a denial of service (server crash). The vulnerability is documented as CVE-2026-11791 with a CVSS 3.1 base score of 5.0 (medium severity). The vendor advisory does not currently specify a patch or mitigation.

Successful exploitation can cause denial of service by crashing the Red Hat Directory Server due to use-after-free or double-free memory errors triggered during schema reload under concurrent LDAP query load. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11791 for current remediation guidance. Until a fix is available, avoid triggering schema reload operations during periods of active LDAP query traffic to reduce the risk of server crashes.