What’s Vulnerable › Vulnerabilities
CVE-2026-58099: Memory safety bugs in kqueue copy-on-fork implementation
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-15 · updated 2026-10-19
- Weakness: CWE-362
Description
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Affected products
- FreeBSD: 15.1, 15.1-p1, 15.1-p2, 15.1-p3
References
Get alerted when CVE-2026-58099 or the next vulnerability affects your stack