CVE-2026-58098
8.4HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
A local unprivileged attacker can trigger out-of-bounds kernel heap memory access to escalate privileges to root. They need local shell or execution access on the system to run semop(2) calls.
Root cause
The 15-bit sequence counter in the semaphore IPC identifier wraps around under heavy creation and deletion, causing semop(2) to access recycled or invalid memory out of bounds after waking.
Affected systems
FreeBSD (specific release versions not listed — check FreeBSD-SA-26:64.sysvsem.asc).
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Apply the kernel patch referenced in FreeBSD advisory FreeBSD-SA-26:64.sysvsem.asc and reboot. No standalone interim mitigation or configuration workaround is documented in the advisory.
$ freebsd-update fetch && freebsd-update installAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.