All vulnerabilities
CVE-2026-58100

FreeBSD: Memory safety bugs in kqueue copy-on-fork implementation

FreeBSD FreeBSDOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published15 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.

Text from CVE List

Affected versions 1

  • FreeBSDaffected: 15.1-RELEASE before p4CVE List

References 1