CVE-2026-58100: Memory safety bugs in kqueue copy-on-fork implementation
kqueueforkcopyknote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.
An unprivileged local user may be able to exploit these races to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeBSD systems where an unprivileged local user can run processes are potentially exposed. The described impact is local privilege escalation, not remote exploitation.
What conditions are required for exploitation?
An attacker needs to trigger a race during fork while concurrently growing the parent process's file descriptor table and registering knotes that reference file descriptors beyond the copied child table. Exploitation depends on winning this timing-sensitive race.
How can I tell whether a system has been affected?
The provided information does not identify a reliable detection method or specific indicators of compromise. Review local privilege changes and unusual activity by unprivileged users, but these are not confirmed indicators for this issue.