SB2026073055 - Multiple vulnerabilities in FreeBSD

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073055

SB2026073055 - Multiple vulnerabilities in FreeBSD

Published: July 30, 2026

Security Bulletin ID SB2026073055
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 17% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2026-58083)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to use-after-free in the FreeBSD kqueue copy-on-fork implementation when copying knotes during fork operations involving timer-based filters. A local user can trigger a race condition to escalate privileges.

The issue can occur when KQUEUE_CPONFORK is used and a timer-based knote fires before copying is complete, which can corrupt the kqueue active list.


2) Use of Uninitialized Variable (CVE-ID: CVE-2026-58084)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization in realtimer_gettime() when returning the previous timer value for a POSIX timer using CLOCK_TAI through timer_settime(2). A local user can create a POSIX timer with CLOCK_TAI and call timer_settime(2) with a non-NULL old_value argument to disclose sensitive information.

The issue occurs when no TAI offset has been configured.


3) Insufficient verification of data authenticity (CVE-ID: CVE-2026-58085)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to inject forged or modified transport data packets into the tunnel.

The vulnerability exists due to improper authentication in wg(4) packet decryption when processing WireGuard data packets through the OpenCrypto framework. A remote attacker can send specially crafted UDP packets or modify intercepted WireGuard packets to inject forged or modified transport data packets into the tunnel.

Exploitation requires the ability to send packets to a WireGuard endpoint and to guess the bounds of the receiver's replay window, or to intercept WireGuard packets bound for the host.


4) Improper access control (CVE-ID: CVE-2026-58086)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disable tracing or modify tracing flags.

The vulnerability exists due to improper access control in the ktrace(2) facility when validating privileged tracing state for processes in jails. A local user can modify or disable a jailed root user's ktrace(2) tracing configuration to disable tracing or modify tracing flags.

Exploitation is limited to a jail and requires permission to debug the target process.


5) Out-of-bounds write (CVE-ID: CVE-2026-58087)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to out-of-bounds read and out-of-bounds write in semctl(2) GETALL and SETALL handling when processing semaphore set control operations during concurrent destruction and recreation of semaphore sets. A local user can rapidly destroy and recreate semaphore sets at the same index to trigger a sequence number wrap and cause out-of-bounds access on kernel heap memory to escalate privileges.

The issue occurs because the semaphore count is recorded before dropping the set lock, and the sequence-number validation can be bypassed after wraparound.


6) Out-of-bounds write (CVE-ID: CVE-2026-58088)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to an out-of-bounds write in the ELF core dump code when counting and populating core dump program headers for dumpable VM map entries. A local user can share an address space with a process that dumps core and mutate the VM map between the two passes to escalate privileges.

Exploitation requires sharing an address space with the target process via rfork(2).


Remediation

Install update from vendor's website.

References