ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation Vulnerability
ZDI disclosed FreeBSD kernel kqueue use-after-free CVE-2026-58093 allowing local privilege escalation.
46
Vulnerability3 · 1 read
CVE-2026-58093
- CVSS 3.1
- 7.0 high
- EPSS
- <1%p0
- Published
- ·
- Modified
Description · NVD
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges.
- Vendors
- freebsd
- Products
- freebsd
- Weakness
- CWE-362, CWE-416
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesFreeBSD kernel TTY race condition allows local privilege escalation
CVE-2026-58093 is rated CVSS 7.8 and requires low-privileged code execution before exploitation.
42