FreeBSD TIOCSCTTY ioctl race escalates privileges
CVE-2026-58093 Published on August 26, 2026
Kernel use-after-free via tty ioctls
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.
An unprivileged local user can exploit this race condition to escalate privileges.
Vulnerability Analysis
CVE-2026-58093 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
What is a Race Condition Vulnerability?
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVE-2026-58093 has been classified to as a Race Condition vulnerability or weakness.
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-58093 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-58093
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.1-RELEASE and below p3 is affected.
- Version 15.0-RELEASE and below p13 is affected.
- Version 14.4-RELEASE and below p9 is affected.