Use After Free in FreeBSD
CVE-2026-58091
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility. On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.
Vulnerability class: Use-After-Free
EPSS: 0.002 (5.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- secteam@freebsd.org (vendor-advisory)
Frequently asked questions
- What is CVE-2026-58091?
- CVE-2026-58091 is a high-severity vulnerability in FreeBSD, classified under Use After Free. CVSS score: 7.8/10. Published 2026-08-26.
- How severe is CVE-2026-58091?
- High severity. CVSS v3 base score is 7.8 out of 10.