The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.
An unprivileged local user can exploit this use-after-free to escalate privileges.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:57.unix.asc | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Sep 2026, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:57.unix.asc - Vendor Advisory | |
| CPE | cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* |
|
| First Time |
Freebsd
Freebsd freebsd |
Information
Published : 2026-08-26 05:18
Updated : 2026-09-24 14:01
NVD link : CVE-2026-58090
Mitre link : CVE-2026-58090
CVE.ORG link : CVE-2026-58090
JSON object : View
Products Affected
freebsd
- freebsd
CWE
CWE-416
Use After Free