Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-58100

Freebsd: out-of-bounds read can lead to privilege escalation

Risk score
42/100
CVSS
7.0 v3.1
Exploit chance (30 days)
0.1%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyo…
Affected
Freebsd
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: FreebsdTHE FLAWSTHE FIXCVE-2026-58100Out-of-bounds read can lead toprivilege escalationCVSS 7.0 · EPSS 0%CVE-2026-101306SCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when…CVSS 9.8 · EPSS 0%CVE-2026-101307Heap buffer overflowCVSS 9.1 · EPSS 0%CVE-2026-101305Renameat(2) did not enforceFD_RESOLVE_BENEATH on itsdirectory argumentsCVSS 8.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedFreebsdAMBER · PATCH THIS WEEKFreebsdSCM_RIGHTS file descriptorpassing did not preserveFD_RESOLVE_BENEATH when adescriptor was transferred. Aprocess could clear therestriction by sending thedescriptor to itself over a Unix…Where it standsNo known exploitationCONNECTS TOSame weaknessOut-of-bounds read (CWE-125)348 other warnings in 30 days →Same productEarlier Freebsd warnings6 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Freebsd: Amber, patch this week. SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use these techniques to …

The flaws

  • CVE-2026-58100: Out-of-bounds read can lead to privilege escalation (CVSS 7.0 · EPSS 0%)
  • CVE-2026-101306: SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was… (CVSS 9.8 · EPSS 0%)
  • CVE-2026-101307: Heap buffer overflow (CVSS 9.1 · EPSS 0%)
  • CVE-2026-101305: Renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments (CVSS 8.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Freebsd

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.0 high

References

Original description

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

Last activity 15 Oct 2026. Patch Forecast updates every hour.