CVE-2026-58093
Kernel use-after-free via tty ioctls
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges.
| CWE | CWE-362 CWE-416 |
| Vendor | freebsd |
| Product | freebsd |
| Published | Aug 26, 2026 |
| Last Updated | Aug 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for freebsd freebsd
Be the first to know when new unknown vulnerabilities affecting freebsd freebsd are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FreeBSD / FreeBSD
15.1-RELEASE < p3 15.0-RELEASE < p13 14.4-RELEASE < p9
References
Credits
tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative