FreeBSD Kernel Kqueue Race Enables Privilege Escalation
CVE-2026-58083 Published on August 19, 2026

Use-after-free in kqueue copy-on-fork
While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races. An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-58083 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-58083 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2026-58083

Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.

FreeBSD
 

Affected Versions

FreeBSD: