CVE-2026-58098

Undergoing Analysis Undergoing Analysis - In Progress

Semop Sequence Number Wrap-Around in FreeBSD Kernel

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-58098

EUVD

EUVD-2026-101855

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE
FreeBSD	FreeBSD	15.0-RELEASE
FreeBSD	FreeBSD	14.5-RELEASE
FreeBSD	FreeBSD	14.4-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a heap out-of-bounds access vulnerability in FreeBSD's semop(2) system call. When semop(2) blocks waiting for a semaphore condition, it releases a lock and sleeps. Upon waking, it checks a 15-bit sequence number in the semaphore set's identifier to detect if the set was removed while asleep. If many semaphore sets are created and destroyed in the same table slot during this time, the sequence number can wrap around, causing semop(2) to incorrectly assume the original set still exists. This leads to an out-of-bounds access to kernel heap memory.

Detection Guidance

Detection primarily involves checking the FreeBSD version against patched releases. Use 'freebsd-version' or 'uname -r' to compare with patched versions listed in FreeBSD-SA-26:64.sysvsem. No direct detection commands exist for this specific vulnerability.

Impact Analysis

An unprivileged local user could exploit this vulnerability to trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation. This means an attacker could gain elevated access to the system, bypassing normal security restrictions.

Compliance Impact

This vulnerability primarily affects system integrity and access controls, which are relevant to compliance with standards like GDPR and HIPAA. An attacker could exploit it to gain elevated privileges, potentially bypassing security controls required by these regulations. For example, GDPR requires protecting personal data through appropriate security measures, and HIPAA mandates safeguarding protected health information. A successful privilege escalation could lead to unauthorized access to sensitive data, violating compliance.

Mitigation Strategies

Upgrade FreeBSD to a patched version using pkg(8), freebsd-update(8), or source code patches. Reboot the system after applying updates. No workarounds are available.

Hi! I’m here to help you understand CVE-2026-58098. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70