CVE-2026-58087: Heap out-of-bounds access in semctl(2)
The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer.
An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems where unprivileged local users can create, destroy, and operate on System V semaphore sets are exposed. The issue is locally exploitable and may allow kernel heap out-of-bounds reads and writes, potentially leading to privilege escalation.
What does an attacker need to do to trigger the flaw?
An attacker needs to race GETALL or SETALL against rapid destruction and recreation of semaphore sets at the same index. They must force the semaphore-set sequence number to wrap after 0x8000 create/destroy cycles so that a replacement set with a different semaphore count passes the validation check.
How can I determine whether an attempted exploitation occurred?
The provided information does not identify a reliable detection artifact. Relevant activity would involve unusually rapid, repeated creation and destruction of System V semaphore sets, combined with GETALL or SETALL operations.