CVE-2026-58094: FIOSSHMLPGCNF ioctl Privilege Escalation

CVE-2026-58094 Overview

CVE-2026-58094 is a race condition vulnerability in the FreeBSD kernel's POSIX shared memory implementation. The flaw resides in the FIOSSHMLPGCNFioctl(2) operation, which configures the page size for largepage shared memory objects. The handler checks whether a page size has already been configured without holding the rangelock, creating a Time-of-Check Time-of-Use ([CWE-367]) window. Two concurrent callers can both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges on affected FreeBSD systems.

Critical Impact
Local unprivileged users can trigger a kernel race condition in POSIX shared memory handling to escalate to root privileges.

Affected Products

FreeBSD operating system (see FreeBSD Security Advisory SA-26:63 for affected releases)
Systems using POSIX shared memory with largepage support
FreeBSD kernel FIOSSHMLPGCNFioctl(2) handler

Discovery Timeline

2026-08-26 - CVE-2026-58094 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-58094

Vulnerability Analysis

The vulnerability affects the FreeBSD kernel path that handles the FIOSSHMLPGCNFioctl(2) command. This ioctl configures the page size on a largepage POSIX shared memory object and is intended to run immediately after object creation, before any memory is allocated. The handler queries whether a page size has already been assigned but performs this check without acquiring the object's rangelock. Concurrent execution by two threads or processes bypasses the intended one-shot configuration semantics. Both callers can pass the check and proceed to install different page sizes on the same shared memory object.

Root Cause

The root cause is a classic TOCTOU race ([CWE-367]). The handler separates the check for prior configuration from the update of the page-size field, and neither operation is serialized under the rangelock that protects the shared memory object's state. The resulting inconsistent state corrupts kernel metadata associated with the object. This corruption is reachable from userspace without special privileges, giving attackers a primitive for privilege escalation.

Attack Vector

Exploitation requires local access with unprivileged user credentials. An attacker creates a largepage POSIX shared memory object, then races two threads issuing FIOSSHMLPGCNF ioctls with conflicting page-size values. Successful races leave the kernel object in a state that can be leveraged to gain elevated privileges. No user interaction is required, and the attack complexity is low once local execution is achieved. Refer to the FreeBSD Security Advisory SA-26:63 for technical specifics on the affected code path.

Detection Methods for CVE-2026-58094

Indicators of Compromise

Unexpected kernel panics or crashes referencing POSIX shared memory (shm_*) subsystems.
Processes issuing repeated FIOSSHMLPGCNF ioctls against the same shared memory descriptor in rapid succession.
Unprivileged user sessions spawning threads that race on shm_open followed by ioctl calls on largepage objects.

Detection Strategies

Audit ioctl(2) telemetry for the FIOSSHMLPGCNF command originating from non-administrative user contexts.
Correlate unexpected privilege transitions with prior use of POSIX shared memory largepage objects.
Monitor kernel logs (dmesg, /var/log/messages) for warnings tied to shared memory object state inconsistencies.

Monitoring Recommendations

Enable FreeBSD audit framework (auditd) rules covering shm_open, ftruncate, and ioctl on shared memory descriptors.
Alert on local user processes that transition to UID 0 following recent shared memory activity.
Track host uptime and reboot patterns; race exploitation attempts commonly generate kernel instability.

How to Mitigate CVE-2026-58094

Immediate Actions Required

Apply the FreeBSD security patch referenced in FreeBSD Security Advisory SA-26:63 as soon as possible.
Inventory FreeBSD hosts and prioritize multi-tenant systems and those with untrusted local users.
Reboot affected systems after patch installation to load the fixed kernel.

Patch Information

FreeBSD has released a kernel patch that acquires the rangelock around the page-size configuration check and update in the FIOSSHMLPGCNFioctl(2) handler. Administrators should follow the update procedure documented in the FreeBSD Security Advisory SA-26:63, which covers both binary patch (freebsd-update) and source rebuild workflows. Confirm the running kernel version after patching to ensure the fix is active.

Workarounds

Restrict local shell access to trusted users on systems that cannot be patched immediately.
Where feasible, disable or restrict use of largepage POSIX shared memory in workloads that do not require it.
Enforce mandatory access controls (MAC) policies to limit which users may invoke ioctl(2) on shared memory objects.

bash

# Apply the FreeBSD security update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Verify the running kernel version after reboot
uname -a
freebsd-version -k