CVE-2026-58099
Freebsd: race condition can lead to privilege escalation
- Risk score
- 42/100
- CVSS
- 7.0 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement opera…
- Affected
- Freebsd
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …
The flaws
- CVE-2026-58099: Race condition can lead to privilege escalation (CVSS 7.0 · EPSS 0%)
- CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
- CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
- CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Freebsd
Where it stands
- No known exploitation
Connects to
- Same weakness: Race condition (CWE-362). 94 other warnings in 30 days
- Same product: Earlier Freebsd warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 7.0 high
References
Original description
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Last activity 15 Oct 2026. Patch Forecast updates every hour.