CVE-2026-5947 is a race condition vulnerability in ISC BIND 9 where a use-after-free condition may occur during SIG(0) signature validation of incoming DNS messages. If the recursive-clients limit is reached during validation, the DNS message may be discarded while still being accessed, causing undefined behavior. This affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. The vulnerability does not affect versions 9.18.28 through 9.18.49 and their S1 variants. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating a high severity impact on availability. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported. Red Hat advisories reference this CVE but do not indicate a released fix or updated packages addressing this issue yet.

The vulnerability can lead to a use-after-free condition causing undefined behavior, including potential crashes or denial of service, impacting the availability of the DNS service. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisories referencing this CVE do not currently list a fix or updated packages addressing this vulnerability. Users should monitor official ISC and Red Hat advisories for updates. Until a fix is available, consider limiting exposure to query floods that might trigger the recursive-clients limit or implement network-level protections to mitigate query floods.