What’s Vulnerable › Vulnerabilities
CVE-2026-58086: ktrace(2) privilege incorrectly validated in jails
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-19 · updated 2026-10-27
- Weakness: CWE-273
Description
As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.
Affected products
- FreeBSD: 15.0, 15.0-p1, 15.0-p10, 15.0-p11, 15.0-p2, 15.0-p3 (+10)
References
Get alerted when CVE-2026-58086 or the next vulnerability affects your stack