SB2026082643 - Race condition in FreeBSD FIOSSHMLPGCNF ioctl handler

Description

This security bulletin contains information about 1 vulnerability.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-58094)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to a time-of-check time-of-use race condition in the FIOSSHMLPGCNF ioctl handler for POSIX shared memory largepage objects when configuring the page size of a largepage shared memory object. A local user can trigger concurrent configuration operations to escalate privileges.

The issue occurs because the check for an existing page size configuration was performed without holding the rangelock, allowing conflicting page sizes to be set on the same object and leaving it in an inconsistent state.

Remediation

Install update from vendor's website.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-26:63.posixshm.asc
• https://cgit.freebsd.org/src/commit/?id=5990860ca841