CVE-2026-58089: hwpmc(4) Privilege Escalation Vulnerability

CVE-2026-58089 Overview

CVE-2026-58089 is a privilege management flaw in the FreeBSD hwpmc(4) hardware performance monitoring counter subsystem. When a process invokes execve(2) to run a setuid or setgid binary, hwpmc(4) is designed to detach Performance Monitoring Counters (PMCs) owned by unprivileged processes. An inverted conditional check causes the kernel to skip this detachment. An unprivileged local user who attaches PMCs to a target process can continue monitoring that process after it executes a privileged binary. This behavior violates the intended isolation policy between unprivileged observers and privileged execution contexts. The issue is categorized as [CWE-273] Improper Check for Dropped Privileges.

Critical Impact
A local unprivileged user can observe the runtime behavior of setuid or setgid programs through hardware performance counters, potentially exposing secrets processed by privileged code.

Affected Products

FreeBSD operating system with hwpmc(4) kernel module enabled
Refer to FreeBSD Security Advisory SA-26:56 for exact affected releases

Discovery Timeline

2026-08-26 - CVE-2026-58089 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58089

Vulnerability Analysis

The FreeBSD hwpmc(4) driver exposes hardware performance counters to userspace for profiling and performance analysis. Access to detailed CPU event data on a process amounts to a side channel into that process's execution. To preserve the setuid and setgid privilege boundary, the kernel is expected to detach any PMC owned by an unprivileged user before the target enters a privileged execution context via execve(2).

The defect is an inverted logical check in the code path that evaluates whether the current execve(2) transitions the process into a setuid or setgid image. Because the condition is reversed, the detachment routine runs only in the non-privileged case and is skipped precisely when it should fire. The counters remain attached across the credential boundary.

The practical consequence is a violation of the confidentiality boundary the kernel is supposed to enforce. Depending on the counters selected, an attacker can observe instruction counts, cache events, branch behavior, and other microarchitectural signals that leak information about data processed by the privileged binary.

Root Cause

The root cause is an inverted conditional in the hwpmc(4)execve(2) hook that determines whether PMCs owned by unprivileged callers must be detached from a process transitioning to a setuid or setgid image. Refer to FreeBSD Security Advisory SA-26:56 for the corrected logic.

Attack Vector

Exploitation requires local access and low privileges. An attacker with a shell account attaches PMCs to a target process using the pmc(3) interfaces, waits for or induces the process to execve(2) a setuid or setgid binary, and continues to sample the counters. No user interaction is required. The vulnerability is described in the security advisory; no public proof of concept is referenced in the CVE data.

Detection Methods for CVE-2026-58089

Indicators of Compromise

Unexpected use of hwpmc(4) device nodes or the pmc(3) library by non-administrative users on production hosts
PMC allocations by unprivileged UIDs that persist across execve(2) transitions into setuid or setgid binaries
Presence of the hwpmc.ko kernel module on systems that do not require performance monitoring

Detection Strategies

Audit process accounting and dtrace traces for unprivileged callers invoking pmc_attach against processes that later execute setuid or setgid images
Correlate loads of the hwpmc kernel module with subsequent process credential transitions using kernel event telemetry
Review installed FreeBSD releases against the version list in FreeBSD Security Advisory SA-26:56

Monitoring Recommendations

Forward kernel module load events and devfs access on /dev/pmc to a centralized logging pipeline
Alert on non-root processes opening /dev/pmc in environments where performance profiling is not an approved workflow
Track patch state of FreeBSD hosts and flag systems still running vulnerable kernels

How to Mitigate CVE-2026-58089

Immediate Actions Required

Apply the kernel update from FreeBSD Security Advisory SA-26:56 and reboot affected hosts
Restrict shell access on multi-user FreeBSD systems until patching is complete
Inventory hosts that load the hwpmc kernel module and prioritize them for remediation

Patch Information

FreeBSD has published a fix in Security Advisory SA-26:56. Administrators should install the corrected kernel following the vendor procedure in the FreeBSD Security Advisory SA-26:56, then reboot to load the patched kernel and hwpmc(4) module.

Workarounds

Unload the hwpmc module with kldunload hwpmc where performance monitoring is not required
Remove hwpmc_load="YES" from /boot/loader.conf to prevent the module from loading at boot
Restrict access to /dev/pmc through devfs rules so only trusted administrative accounts can open the device

bash

# Disable hwpmc(4) loading on FreeBSD until the patch is applied
sysrc -f /boot/loader.conf hwpmc_load=NO
kldunload hwpmc 2>/dev/null || true

# Restrict /dev/pmc via devfs rules (example ruleset)
cat >> /etc/devfs.rules <<'EOF'
[localrules=10]
add path 'pmc' mode 0600 group wheel
EOF
service devfs restart