CVE-2026-58098
Freebsd: out-of-bounds write can lead to privilege escalation
- Risk score
- 52/100
- CVSS
- 8.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore se…
- Affected
- Freebsd
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …
The flaws
- CVE-2026-58098: Out-of-bounds write can lead to privilege escalation (CVSS 8.4 · EPSS 0%)
- CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
- CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
- CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Freebsd
Where it stands
- No known exploitation
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 257 other warnings in 30 days
- Same product: Earlier Freebsd warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 8.4 high
References
Original description
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.
Last activity 15 Oct 2026. Patch Forecast updates every hour.