FreeBSD ioctl Use-After-Free in Audio Sync Group Enables Priv Escalation
CVE-2026-58091 Published on August 26, 2026

Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility. On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-58091 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-58091 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2026-58091

Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.

FreeBSD
 

Affected Versions

FreeBSD: