VulnerabilityUndergoing Analysis

CVE-2026-58090

An unprivileged local user can exploit this use-after-free to escalate privileges.

HIGH 7.8EPSS 0.13%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-416
Source: secteam@freebsd.org

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:57.unix.asc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.