ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
ZDI disclosed FreeBSD kernel shared-memory TOCTOU bug CVE-2026-58094 enabling local privilege escalation.
The Zero Day Initiative published ZDI-26-785, a time-of-check time-of-use flaw in FreeBSD kernel shared memory tracked as CVE-2026-58094. A local attacker who can already execute low-privileged code can escalate privileges on affected systems. ZDI assigned a CVSS score of 7.8. The advisory does not report active exploitation.
- ZDI-26-785 is a shared-memory time-of-check time-of-use bug.
- CVE-2026-58094 allows local privilege escalation and is rated CVSS 7.8.
- Exploitation requires the attacker to already run low-privileged code.
Vulnerabilities mentionedAll →
- CVE-2026-580947.8<1%The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory objectpublished · freebsd freebsd
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-58094 | The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges. |
This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-58094.
This source does not provide full text. Read it at zerodayinitiative.com.