CVE-2026-58091: Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

Published Aug 26, 2026
·
Updated

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.

On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

Affected Software

23 affected components
Linux Kernel
FreeBSD FreeBSD=14.4-p1
FreeBSD FreeBSD=14.4-p2
FreeBSD FreeBSD=14.4-p3
FreeBSD FreeBSD=14.4-p4
FreeBSD FreeBSD=14.4-p5
FreeBSD FreeBSD=14.4-p6
FreeBSD FreeBSD=14.4-p7
FreeBSD FreeBSD=14.4-p8
FreeBSD FreeBSD=15.0-p1
FreeBSD FreeBSD=15.0-p10
FreeBSD FreeBSD=15.0-p11
FreeBSD FreeBSD=15.0-p12
FreeBSD FreeBSD=15.0-p2
FreeBSD FreeBSD=15.0-p3
FreeBSD FreeBSD=15.0-p4
FreeBSD FreeBSD=15.0-p5
FreeBSD FreeBSD=15.0-p6
FreeBSD FreeBSD=15.0-p7
FreeBSD FreeBSD=15.0-p8
FreeBSD FreeBSD=15.0-p9
FreeBSD FreeBSD=15.1-p1
FreeBSD FreeBSD=15.1-p2

Event History

Aug 26, 2026
CVE Published
via MITRE·04:38 AM
Data Sourced
via MITRE·04:38 AM
DescriptionWeakness
Data Sourced
via NVD·05:18 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Systems with multiple audio devices are exposed if unprivileged local users can access the affected audio ioctl. The issue is described as a local privilege-escalation vulnerability.

2

What does an attacker need to exploit it?

An attacker needs local access as an unprivileged user and a system with multiple audio devices. Exploitation involves the SNDCTL_DSP_SYNCSTART ioctl and a timing condition in which the sync group is freed while the ioctl is sleeping.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203