Privilege Escalation Vulnerability in FreeBSD's hwpmc Component

CVE-2026-58089

What is CVE-2026-58089?

The hwpmc component in FreeBSD mishandles process management when a setuid or setgid binary is executed. An unprivileged local user with attached Performance Monitoring Counters (PMCs) can bypass intended protections, continuing to monitor processes after their execution. This flaw arises from an inverted check that overlooks the privileges of the user, potentially leading to unauthorized information access and manipulation during critical operations.

References