CVE-2026-58099

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

Score
CVSS 3.1 7.0 High
Status
Analyzed - secteam@freebsd.org
Published
2026-10-15
Last modified
2026-10-19
Weaknesses
CWE-362, CWE-416

Affected products

References

 
 
© AVABIS GmbH privacypolicy about