CVE-2026-58087: semctl(2) Privilege Escalation Vulnerability

CVE-2026-58087 Overview

CVE-2026-58087 is a kernel heap out-of-bounds read and write vulnerability in the FreeBSD System V semaphore subsystem. The flaw affects the GETALL and SETALL commands in semctl(2). A sequence-number wraparound after 0x8000 create/destroy cycles allows validation to pass when the underlying set has changed size. An unprivileged local user can trigger the condition to read or write past a kernel heap buffer. The issue is tracked under CWE-125 and detailed in the FreeBSD Security Advisory.

Critical Impact
An unprivileged local user can corrupt kernel heap memory, potentially leading to local privilege escalation to root.

Affected Products

FreeBSD operating system (System V semaphore subsystem sysvsem)
Kernel semctl(2) implementation handling GETALL and SETALL
Refer to the FreeBSD Security Advisory for specific affected releases

Discovery Timeline

2026-08-19 - CVE-2026-58087 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-58087

Vulnerability Analysis

The semctl(2) system call implements GETALL and SETALL operations that copy the entire semaphore array between userspace and kernel space. The kernel first reads the number of semaphores (nsems) in the target set while holding the set's lock. It then drops the lock to allocate a heap buffer sized for that count. After reacquiring the lock, the kernel copies data into or out of that buffer.

Because allocation happens without the lock held, the kernel validates that the set was not replaced during the window. Validation relies on a per-slot sequence number. However, the sequence number is a bounded counter that wraps after 0x8000 create/destroy cycles. A concurrent process that rapidly destroys and recreates a semaphore set at the same index can force the sequence number to collide with its earlier value. The stale check then accepts a replacement set that contains a different nsems. The subsequent copy operates on a buffer sized for the original set and reads or writes past its bounds on the kernel heap.

Root Cause

The root cause is insufficient state validation across a lock drop, combined with a finite sequence-number space. The 15-bit sequence counter wraps predictably, defeating the anti-replacement check.

Attack Vector

Exploitation requires local access and unprivileged user permissions. The attacker races two threads: one issues semctl(id, 0, GETALL, ...) or SETALL against a target set, and the other repeatedly calls semget(2) and IPC_RMID at the same key to churn slot allocations until the sequence number wraps. Successful races produce out-of-bounds heap reads to leak kernel memory or out-of-bounds writes to corrupt adjacent allocations. Kernel heap corruption is a known primitive for local privilege escalation. See the FreeBSD Security Advisory for reference-level detail.

Detection Methods for CVE-2026-58087

Indicators of Compromise

Unexpected kernel panics or page fault traps originating in sysvsem code paths such as semctl, sem_leave, or semundo_adjust.
Processes issuing high-frequency semget(2) and semctl(..., IPC_RMID, ...) sequences from unprivileged users.
Unexplained UID transitions to root shortly after heavy System V IPC activity.

Detection Strategies

Audit semctl and semget system call telemetry with dtrace or auditd equivalents, focusing on rapid create/destroy loops from a single PID.
Correlate kernel crash dumps with recent user-space IPC activity to identify race attempts.
Alert on unprivileged processes generating thousands of IPC lifecycle operations per second.

Monitoring Recommendations

Enable FreeBSD audit(4) with the ip (IPC) event class and forward records to a central log store.
Track kernel panic frequency and stack traces containing sysvsem symbols.
Monitor ipcs -s state changes for abnormal churn on semaphore sets.

How to Mitigate CVE-2026-58087

Immediate Actions Required

Apply the kernel update from the FreeBSD Security Advisory FreeBSD-SA-26:54.sysvsem and reboot affected hosts.
Restrict shell access on multi-tenant FreeBSD systems until patches are deployed.
Review privilege boundaries for services that expose local execution to untrusted users.

Patch Information

FreeBSD has published a fix in advisory FreeBSD-SA-26:54.sysvsem. Rebuild the kernel from a patched source tree or install the vendor-provided binary update using freebsd-update. Reboot is required for the new kernel to take effect.

Workarounds

Disable the System V semaphore module where it is not required by removing sysvsem from the kernel or unloading sysvsem.ko with kldunload sysvsem if no local applications depend on it.
Restrict local login accounts and remove interactive access for untrusted users on unpatched hosts.
Constrain workloads with jail(8) configurations that disallow System V IPC where practical.

bash

# Apply the FreeBSD binary update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Optional: unload the sysvsem module if not required
kldunload sysvsem