Local Privilege Escalation Vulnerability in FreeBSD Audio Drivers

CVE-2026-58091

What is CVE-2026-58091?

A vulnerability exists within the FreeBSD audio drivers due to improper handling during the synchronization lock acquisition process. When an ioctl operation attempts to lock channels in a sync group, it can inadvertently release the sync group list lock if blocking occurs. Upon resumption from sleep, the sync group structure may have been freed, potentially leading to exploitation by an unprivileged local user who can leverage the use-after-free condition to escalate their privileges on the system. This issue underscores the critical need for developers to implement robust memory management practices to prevent similar vulnerabilities.

References