CVE-2026-58092: FreeBSD 15.0 Privilege Escalation Vulnerability

CVE-2026-58092 Overview

CVE-2026-58092 is a privilege escalation vulnerability in FreeBSD 15.0 affecting the mac_do Mandatory Access Control module. The flaw resides in the group_is_primary() kernel function, which was not updated when FreeBSD 15.0 restructured its user credential representation. Specific mac_do transition rules can be abused to set a process's primary group ID to an unintended value, including group 0 (wheel). Under certain system configurations, attackers can chain this behavior to obtain root privileges. FreeBSD published Security Advisory SA-26:59 on August 26, 2026, describing the issue and its exploitation preconditions.

Critical Impact
Local users targeted by a mac_do transition rule can escalate to the wheel group and potentially to root, depending on ruleset and supplementary group state.

Affected Products

FreeBSD 15.0 (kernel with mac_do module enabled)
Systems configured with mac_do transition rules referencing the calling user
FreeBSD installations relying on group 0 (wheel) for privilege gating

Discovery Timeline

2026-08-26 - CVE-2026-58092 published to NVD
2026-08-26 - FreeBSD Security Advisory SA-26:59 released
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-58092

Vulnerability Analysis

FreeBSD 15.0 changed the in-kernel ucred structure so the primary group ID resides in a dedicated field rather than the first slot of the supplementary group array. The group_is_primary() helper, invoked by mac_do when a transition rule omits an explicit target group, still reads the legacy array position. When mac_do applies a rule such as uid=1001>uid=1002, it derives the new primary GID from stale layout assumptions. The result is that the new credential inherits the first element of the caller's supplementary group array as its primary GID. This is classified under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Root Cause

The root cause is an incomplete refactor of credential-handling code. group_is_primary() was not migrated to read the dedicated primary GID field introduced in FreeBSD 15.0. The function silently returns incorrect data instead of failing, allowing mac_do to propagate an attacker-influenced value into the new credential.

Attack Vector

Exploitation requires that a mac_do rule apply to the caller. A user with UID 1001, targeted by rule uid=1001>uid=1002, can trigger the credential switch. If the process removes itself from all supplementary groups using the privileged setgroups(2) call, the first element of the supplementary array reads as 0, corresponding to the wheel group. Rulesets that chain group transitions, for example uid=1001>uid=1002;gid=0>uid=0, can then be abused to elevate to UID 0. Users with non-empty supplementary group lists can at most gain the first supplementary group's identity.

No verified proof-of-concept code has been published. See the FreeBSD Security Advisory SA-26:59 for authoritative technical details.

Detection Methods for CVE-2026-58092

Indicators of Compromise

Unexpected process credentials showing primary GID 0 (wheel) for users not administratively assigned to that group.
Audit records containing setgroups(2) calls that reduce the supplementary group list to empty prior to a mac_do-driven UID transition.
Shell or interactive sessions where id output reflects gid=0(wheel) without matching /etc/group membership.

Detection Strategies

Enable FreeBSD auditd with rules covering setgroups, setuid, and credential-modifying syscalls, then alert on sequences that end with GID 0.
Inventory active mac_do rulesets and flag any rule that targets a user UID without explicitly specifying a target GID.
Correlate process execution telemetry with expected group membership from /etc/group to surface discrepancies.

Monitoring Recommendations

Forward FreeBSD audit logs to a centralized analytics platform and alert on credential transitions ending in privileged groups.
Monitor changes to /etc/mac.conf and any file referenced by mac_do rule definitions.
Track invocations of mdo(1) or other mac_do client utilities by non-administrative users.

How to Mitigate CVE-2026-58092

Immediate Actions Required

Apply the FreeBSD patch referenced in Security Advisory SA-26:59 and reboot affected hosts to load the corrected kernel.
Audit all mac_do rulesets and remove or rewrite rules that transition UIDs without specifying an explicit target GID.
Restrict mac_do deployment to hosts where the ruleset has been reviewed and is required for operational purposes.

Patch Information

FreeBSD has issued fixes as documented in FreeBSD Security Advisory SA-26:59. The corrected group_is_primary() implementation reads the dedicated primary GID field in the updated ucred structure. Administrators should apply the errata patch via freebsd-update or rebuild the kernel from the patched source tree, then reboot.

Workarounds

Unload the mac_do kernel module on systems that do not require it: kldunload mac_do and remove any mac_do_load="YES" entries from /boot/loader.conf.
Rewrite mac_do rules to always specify an explicit target GID, avoiding rules that rely on implicit primary group resolution.
Restrict which users are covered by mac_do transition rules to reduce the population of accounts that can trigger the flaw.

bash

# Disable mac_do until patched kernel is deployed
kldunload mac_do
sysrc -f /boot/loader.conf mac_do_load="NO"

# Apply FreeBSD errata patch and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now