What’s Vulnerable › Vulnerabilities
CVE-2026-58090: Use-after-free in unix SOCK_STREAM message handling
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-26 · updated 2026-09-24
- Weakness: CWE-416
Description
The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.
Affected products
- FreeBSD: 15.0-p1, 15.0-p10, 15.0-p11, 15.0-p12, 15.0-p2, 15.0-p3 (+8)
References
Get alerted when CVE-2026-58090 or the next vulnerability affects your stack