CVE-2026-58100

Undergoing Analysis Undergoing Analysis - In Progress

Race Condition in FreeBSD kqueue Leading to Privilege Escalation

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: FreeBSD

Description

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-58100

EUVD

EUVD-2026-101857

Affected Vendors & Products

Vendor	Product	Version / Range
FreeBSD	FreeBSD	15.1-RELEASE

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves a race condition in the kqueue copy-on-fork implementation in FreeBSD. When a process forks, the child's file descriptor table is copied before knotes (kernel event notifications) are transferred. A concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the child's table size. This causes an out-of-bounds read when kqueue_fork_copy_knote() indexes into the child's table without bounds checking.

Detection Guidance

This vulnerability is specific to FreeBSD systems and requires local access to exploit. Detection involves checking the FreeBSD version and applying patches. Use 'freebsd-version' or 'uname -r' to verify your FreeBSD version. If running FreeBSD 15.1, check for available updates via 'freebsd-update fetch' and 'freebsd-update install'.

Impact Analysis

An unprivileged local user could exploit this vulnerability to escalate privileges on the system. This could allow the attacker to gain higher-level access than intended, potentially leading to unauthorized control over the system or sensitive data.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local privilege escalation issue in FreeBSD. Standards like GDPR and HIPAA focus on data protection, access controls, and system integrity, but this flaw does not inherently violate those requirements unless exploited to gain unauthorized system access.

Mitigation Strategies

Immediately update FreeBSD to a patched version. Use 'freebsd-update fetch' followed by 'freebsd-update install' or upgrade via 'pkg update && pkg upgrade'. Alternatively, apply source code patches from the stable/15 or releng/15.1 branches committed on September 29, 2026.

Hi! I’m here to help you understand CVE-2026-58100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70