Semaphore Condition Vulnerability in FreeBSD Kernel

CVE-2026-58098

What is CVE-2026-58098?

This vulnerability arises when the semop(2) system call blocks while waiting for a semaphore condition. During this time, it releases the per-set lock and sleeps. Upon waking, it checks a sequence number embedded within the semaphore set's IPC identifier to ascertain if the set was removed during the sleep period. Limited to just 15 bits, this sequence number can wrap around if multiple semaphore sets are created and destroyed within the same table slot while the caller is blocked. This may lead semop(2) to mistakenly determine that the original semaphore set remains intact. Consequently, any subsequent attempts to access a semaphore within this set may result in out-of-bounds access to kernel heap memory, which can be exploited by unprivileged local users, possibly leading to privilege escalation.

References