Class 09 · KP 07 / 25

tcache: The Per-Thread Cache (glibc 2.26+)

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

Introduced in glibc 2.26 (2017) for speed: each thread keeps its own cache of freed chunks, avoiding arena locking.
Structure: an array of single-linked lists, one per small size class, operated LIFO (last freed, first returned).
Default: up to 7 chunks per size bin cached.
A freed chunk's fd (called next here) points to the next cached chunk. malloc of that size just pops the head.
Why it made attacks easier: early tcache had almost no integrity checks. A single-linked list plus no checks means corrupting next directly controls the next allocation.

Key Takeaway

tcache is fast and simple — and its simplicity briefly made heap exploitation dramatically easier.