Time-of-check Time-of-use (TOCTOU) Race Condition in FreeBSD - CVE-2026-58094
Published: August 26, 2026
Vulnerability identifier: #VU145742
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58094
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a time-of-check time-of-use race condition in the FIOSSHMLPGCNF ioctl handler for POSIX shared memory largepage objects when configuring the page size of a largepage shared memory object. A local user can trigger concurrent configuration operations to escalate privileges.
The issue occurs because the check for an existing page size configuration was performed without holding the rangelock, allowing conflicting page sizes to be set on the same object and leaving it in an inconsistent state.
Affected software
FreeBSD
How to mitigate CVE-2026-58094
Install security update from vendor's website.