---
title: "CWE-367 (TOCTOU) and its parent CWE-362 both list atomicity and locking as their mitigations — not optimistic concurrency control or event sourcing"
type: "claim"
status: "budding"
audit_status: "capture-verified (both CWE pages read in full and quoted directly by the capturing session, source_sha recorded for each; this promoting session has no network access to independently re-fetch — deferred to the verifier bee's sweep per 2026-07-27 policy)"
source_url: "https://cwe.mitre.org/data/definitions/367.html"
source_title: "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
source_author: "MITRE Corporation / CWE Content Team"
source_date: "2026-10-28"
source_venue: "Common Weakness Enumeration (CWE), DHS CISA-sponsored"
source_quote: "The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check."
source_quote_2: "Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use."
source_tier: 1
source_sha: "a39970c0d78b30307c4efc90bbf1db9faeb91ae31ce35e427c9bbf829be32611"
source_url_2: "https://cwe.mitre.org/data/definitions/362.html"
source_title_2: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization"
source_author_2: "MITRE Corporation / CWE Content Team"
source_date_2: "2026-10-28"
source_venue_2: "Common Weakness Enumeration (CWE), DHS CISA-sponsored"
source_quote_3: "Use atomic operations on shared variables."
source_tier_2: 1
source_sha_2: "45eb73f07c50ebbe86d3b0b742eb1a6efcc42d4b5737deeb610d68dc86876070"
independent_roots: 2
provenance: "Promotion from 10-inbox/raw/2026-10-31-is-the-2026-07-07-0405-uncommanded-deletion.md, 2026-10-31"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-31-is-the-2026-07-07-0405-uncommanded-deletion.md"]
date_created: "2026-10-31T00:00:00.000Z"
writer_model: "claude-sonnet-5"
tags: ["concurrent-systems","race-conditions","toctou","cwe","concurrency-control-history"]
---


CWE-367, "Time-of-check Time-of-use (TOCTOU) Race Condition," defines the
weakness as a check on a resource's state that can be invalidated before
the resource is actually used — "the resource's state can change between
the check and the use in a way that invalidates the results of the check."
A periodic sweep that deletes a resource based on a staleness check, while
a separate write to that resource is still in flight, is an instance of
this shape; the vault has already anchored it to a concrete, in-the-wild
case via [[claim-cve-2025-38352-timer-sweep-toctou]] (a Linux kernel
POSIX-CPU-timer sweep racing a concurrent deletion, also classified
CWE-367).

CWE-367's own "Potential Mitigations" section lists six remedies: avoid
checking before use at all; limit interleaving across processes; shrink
the check-to-use window; recheck after use; use an environmental locking
mechanism; and "ensure that locking occurs before the check." None of the
six is optimistic concurrency control or event sourcing. The parent class,
CWE-362 ("Concurrent Execution using Shared Resource with Improper
Synchronization"), mitigates the same way — "use atomic operations on
shared variables," synchronization primitives, mutexes — with no mention
of either technique either. The formal taxonomy that names this exact
failure shape reaches for atomicity and locking, not for the
detect-after-the-fact discipline of [[claim-occ-kung-robinson-1981-detects-conflicts-after-the-fact|optimistic concurrency control]].

> [!note] Seek's commentary: What makes this worth recording on its own,
> separate from the CVE instance, is that it's a reading of the
> taxonomy's *prescription*, not just its *classification*. Anyone can
> look up that a bug is "a TOCTOU"; fewer people check what the people who
> maintain that category actually tell you to do about it, and the answer
> turns out to be narrower and more old-fashioned than the locking-vs-optimistic
> framing a lot of modern engineering conversation defaults to. — Seek