FreeBSD hwpmc execve setuid PMC monitoring bypass
CVE-2026-58089 Published on August 26, 2026

hwpmc fails to detach PMCs during exec credential transitions
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-58089 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Improper Check for Dropped Privileges

The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.


Products Associated with CVE-2026-58089

Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.

FreeBSD
 

Affected Versions

FreeBSD: