CVE-2026-58099: FreeBSD Privilege Escalation Vulnerability

CVE-2026-58099 Overview

CVE-2026-58099 is a race condition in the FreeBSD kernel kqueue subsystem. When copying knotes from a parent kqueue to a child, the copy routine fails to exclude marker knotes before marking them as in-flux and releasing the kqueue lock. A concurrent thread can free the marker while the lock is dropped, causing the subsequent in-flux decrement to operate on freed memory. The flaw is tracked under [CWE-362] (concurrent execution using shared resource with improper synchronization).

Critical Impact
An unprivileged local user may exploit the race to corrupt kernel memory and escalate privileges to root on affected FreeBSD 15.1 systems.

Affected Products

FreeBSD 15.1 (base release)
FreeBSD 15.1-p1, 15.1-p2, 15.1-p3
Systems exposing kqueue(2) to unprivileged local users

Discovery Timeline

2026-10-15 - CVE-2026-58099 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-58099

Vulnerability Analysis

The kqueue subsystem in FreeBSD provides a scalable event notification facility. Internally, the kernel uses marker knotes as sentinels to track position during list traversal under the kqueue lock. These markers are stack-allocated by the traversing thread and must never be treated as real knotes subject to reference counting or lifecycle management.

During the parent-to-child kqueue copy operation, the code iterates the knote list to clone entries. The copy path incorrectly includes marker knotes when flipping the KN_INFLUX state and then drops the kqueue lock to perform allocation. During that window, the thread owning the marker can complete its traversal and reclaim the marker from its stack frame. When the copy routine reacquires the lock and decrements the in-flux counter, it writes to memory that no longer belongs to a valid knote.

Root Cause

The root cause is missing type discrimination in the copy loop. Marker knotes carry a flag such as KN_MARKER that distinguishes them from live knotes, but the copy routine does not check this flag before manipulating state and releasing the lock. The result is a classic time-of-check versus time-of-use window combined with a use-after-free on stack-resident kernel memory.

Attack Vector

Exploitation requires local code execution as an unprivileged user. The attacker creates a kqueue, registers events, and triggers the copy path (for example, via fork(2) or descriptor inheritance) while a second thread races to complete traversal and reclaim the marker. Winning the race corrupts kernel memory at a controlled offset, which an attacker can shape into a privilege escalation primitive. The attack complexity is high because reliable exploitation depends on precise scheduler timing, but no user interaction is needed. Technical specifics are documented in the FreeBSD Security Advisory SA-26:65.

Detection Methods for CVE-2026-58099

Indicators of Compromise

Unexpected kernel panics referencing knote_drop, kqueue_scan, or kqueue_register in crash dumps
ddb or kgdb backtraces showing double-free or in-flux decrement on freed memory
Sudden transitions of unprivileged processes to UID 0 without an audited setuid call

Detection Strategies

Enable FreeBSD audit (auditd) with policies covering kqueue, fork, and privilege elevation events
Correlate process lineage so that children of unprivileged shells acquiring root are flagged for review
Monitor /var/crash for recurrent kernel panics in the kqueue code paths that indicate exploitation attempts

Monitoring Recommendations

Forward kernel log messages and audit records to a centralized log store for retention and querying
Alert on repeated fork/kqueue syscall bursts from a single unprivileged process, a pattern consistent with race-winning attempts
Track installed kernel version across the fleet and alert when hosts remain on unpatched FreeBSD 15.1 revisions

How to Mitigate CVE-2026-58099

Immediate Actions Required

Apply the FreeBSD base system patch referenced in FreeBSD-SA-26:65 and reboot affected hosts
Inventory all FreeBSD 15.1 systems, including appliances and virtual machines, to confirm patch coverage
Restrict shell and local execution access on multi-tenant FreeBSD hosts until patching completes

Patch Information

FreeBSD has published a kernel patch via the official security advisory FreeBSD-SA-26:65. Administrators should apply the patch using freebsd-update fetch install on supported branches or rebuild the kernel from updated sources, then reboot to activate the fix.

Workarounds

No supported configuration workaround exists; the fix requires the patched kernel
Reduce exposure by limiting local user access and enforcing strict jail(8) separation for untrusted workloads
Enable security.bsd.unprivileged_proc_debug=0 and other hardening sysctls to reduce the attacker's local toolkit

bash

# Apply the FreeBSD security patch and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now

# Verify the running kernel patch level
freebsd-version -k
uname -a