CVE-2026-58083

Analyzed Analyzed - Analysis Complete

Kernel Use-After-Free in FreeBSD

Publication date: 2026-08-19

Last updated on: 2026-08-31

Assigner: FreeBSD

Description

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races. An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-31

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-58083

EUVD

EUVD-2026-62351

Affected Vendors & Products

Vendor	Product	Version / Range
freebsd	freebsd	15.1
freebsd	freebsd	15.1
freebsd	freebsd	15.1
freebsd	freebsd	15.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in FreeBSD's kqueue subsystem. During a fork operation, a race condition occurs where a knote with a timer-based filter fires before the copy completes. This causes the knote to be enqueued twice on the active list, corrupting it. The copy routine also fails to hold proper locks while reading knote state, leading to additional race conditions.

Detection Guidance

Detection requires checking the FreeBSD version and kqueue subsystem behavior. Use 'freebsd-version' to verify if your system is running FreeBSD 15.1. Monitor kernel logs for unusual kqueue-related errors or crashes. No direct commands detect the vulnerability itself, but system logs may show signs of kernel instability or use-after-free errors.

Impact Analysis

An unprivileged local user can exploit this flaw to trigger a use-after-free in the kernel, potentially leading to privilege escalation. This could allow an attacker to gain elevated access to the system.

Compliance Impact

This vulnerability is a kernel-level use-after-free issue in FreeBSD's kqueue subsystem that could allow local privilege escalation. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is not a data breach or privacy violation but rather a system integrity risk. Compliance impact would depend on whether the affected system processes regulated data and if the exploit leads to unauthorized access.

Mitigation Strategies

Upgrade FreeBSD to a patched version of 15.1 or later immediately. Use 'pkg update && pkg upgrade' or 'freebsd-update fetch install' to apply patches. Reboot the system after updating. Avoid using kqueue in copy-on-fork mode (KQUEUE_CPONFORK) if possible until patched.

Hi! I’m here to help you understand CVE-2026-58083. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70