CVE-2026-58093

Undergoing Analysis Undergoing Analysis - In Progress

Linux Kernel TIOCSCTTY Race Condition Leads to Privilege Escalation

Publication date: 2026-08-26

Last updated on: 2026-08-27

Assigner: FreeBSD

Description

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-27

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-58093

EUVD

EUVD-2026-66250

Affected Vendors & Products

Vendor	Product	Version / Range
freebsd	freebsd	to 2026-08-25 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in the TIOCSCTTY ioctl handler in FreeBSD. The handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal state after reacquiring the tty lock. This allows a malicious local user to link a terminal that is being destroyed to their process session, enabling privilege escalation.

Detection Guidance

This vulnerability is a local privilege escalation issue in FreeBSD related to the TIOCSCTTY ioctl handler. Detection requires checking for unusual process behavior or terminal session manipulation. No specific commands are provided in the context, but monitoring for unexpected privilege changes or terminal session modifications may help identify exploitation attempts.

Impact Analysis

An unprivileged local user can exploit this flaw to gain elevated privileges on the system. This could allow them to execute arbitrary code with higher permissions, potentially leading to full system compromise or unauthorized access to sensitive data.

Compliance Impact

This vulnerability is a local privilege escalation flaw in FreeBSD's kernel. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is not a data breach or exposure issue. Compliance impacts would only occur if the vulnerability were exploited to gain unauthorized access to sensitive data or systems, which is not described in the provided context.

Mitigation Strategies

Apply the latest FreeBSD security patches or updates that address this issue. Since this is a local privilege escalation, restrict unprivileged user access to sensitive operations and monitor for suspicious activity. No specific mitigation commands are provided in the context.

Hi! I’m here to help you understand CVE-2026-58093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70