Privilege Escalation Vulnerability in FreeBSD Unix Socket Implementation

CVE-2026-58090

What is CVE-2026-58090?

A vulnerability exists in the Unix socket implementation of FreeBSD where the SOCK_STREAM receive path does not adequately detach control messages from the socket buffer prior to processing. This oversight can lead to certain error paths that free those messages, resulting in freed data mbufs remaining in the receive socket buffer. An unprivileged local user may exploit this use-after-free vulnerability to escalate their privileges, posing significant security risks to affected systems.

References