Out-of-Bounds Read and Write Vulnerability in FreeBSD Semaphore Management

CVE-2026-58087

What is CVE-2026-58087?

This vulnerability occurs in the semaphore management functionality of FreeBSD. It arises when the GETALL and SETALL commands in semctl(2) manage semaphore sets. Due to an improper sequence number validation process, an attacker can exploit this by rapidly creating and destroying semaphore sets at the same index. This exploitation may lead to a condition where the sequence number wraps, allowing a different semaphore set to pass validation checks. The result is that the system can read from or write to kernel heap memory beyond the intended boundaries, enabling an unprivileged local user to potentially escalate their privileges.

References