CVE-2026-58089
hwpmc fails to detach PMCs during exec credential transitions
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.
| CWE | CWE-273 |
| Vendor | freebsd |
| Product | freebsd |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for freebsd freebsd
Be the first to know when new high vulnerabilities affecting freebsd freebsd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreeBSD / FreeBSD
15.1-RELEASE < p3 15.0-RELEASE < p13 14.4-RELEASE < p9
References
Credits
Alexander Leidinger