CVE-2026-58099
Memory safety bugs in kqueue copy-on-fork implementation
Published Oct 15, 2026 · updated Oct 15, 2026 · FreeBSD FreeBSD
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these race
Oct 15, 2026 · NIST NVD
Updated
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these race
Affected
- vendor FreeBSD FreeBSDversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped,
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-58099
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-58099
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped
nvd.nist.gov