CVE-2026-58092 in FreeBSD
Summary
by MITRE • 08/26/2026
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely internal to the kernel and not user-visible.
One function, group_is_primary(), was not properly updated as a part of this transition. This function is used by mac_do to determine the primary group ID of the credential after applying a transition rule, used when the rule target does not explicitly specify a group.
As a result, with certain mac_do rules, it is possible for a credential switch to incorrectly set the primary group ID to the ID stored in the first element of the original credential's supplementary group array.
If the list of supplementary groups is empty, this value will be 0, corresponding to the "wheel" group. For example, a rule such as "uid=1001>uid=1002" can be abused to set the primary group ID to 0 even if the process did not originally belong to group 0.
Certain mac_do rules can be abused to set a process' group ID to 0. Note however, that the rule must apply to the caller in order for the bug to be triggered, e.g., given the ruleset "uid=1001>uid=1002", the user must have user ID 1001 in order to trigger the bug.
Further, logged-in users will in general have a non-empty supplementary group list, in which case the bug can at worst be used to set the credential's first supplementary group ID as its primary group ID. Processes must explicitly remove themselves from all supplementary groups, using the privileged setgroups(2) system call, in order to exploit the bug to set 0 as the primary group ID.
Since membership in group 0 is often used to enable controlled privilege escalation, the bug might be further exploitable to obtain root privileges, depending on the system configuration. For instance, a ruleset such as the following could be exploited by a process running as user 1001 and with an empty supplementary group list: "uid=1001>uid=1002;gid=0>uid=0".
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
In FreeBSD version 15.0, a significant architectural change was implemented within the kernel to restructure how user credentials are represented in memory. Previously, the primary group identifier for a process or thread was stored as the first element of an array that also contained supplementary group identifiers. The updated design separates this data by placing the primary group ID into its own dedicated field while maintaining the supplementary groups in a separate list. This refactoring was intended to be transparent to user-space applications and largely internal to the kernel's security model, aiming to improve clarity and maintainability of credential structures without altering external behavior or application interfaces.
However, this transition introduced a logic error in the mac_do function, which is responsible for enforcing Mandatory Access Control policies defined by MAC (Mandatory Access Control) frameworks such as TrustedBSD. The mac_do routine utilizes an internal helper function named group_is_primary to determine the primary group identifier of a credential after applying specific policy rules. This determination becomes critical when a transition rule targets a user identity but does not explicitly specify a target group, requiring the system to infer or preserve appropriate group attributes based on existing credentials.
The flaw arises because the group_is_primary function was not updated to reflect the new memory layout where primary and supplementary groups are stored in distinct locations. Instead of reading from the dedicated field for the primary group ID, this function incorrectly reads from what it assumes is still the first element of a combined array containing both primary and supplementary identifiers. Consequently, when processing certain mac_do rules that do not explicitly define a target group, the system may erroneously assign the value found in the original credential's supplementary group list as the new primary group ID rather than preserving or correctly calculating the intended primary group status.
The operational impact of this vulnerability depends heavily on the state of the process credentials at the time of execution. If a process has an empty list of supplementary groups, the memory location that would have held the first supplementary identifier contains zero by default in many implementations. Since group ID 0 corresponds to the wheel group, which typically possesses administrative privileges and root-equivalent capabilities, this error can result in a credential switch that incorrectly grants the process membership in the wheel group. This effectively elevates the privilege level of the affected process without explicit authorization for such high-level access.
Exploitation requires specific conditions regarding both the MAC policy ruleset and the initial state of the attacker's credentials. The malicious rule must apply to the caller, meaning a user with ID 1001 could exploit a rule transitioning uid=1001 to uid=1002 if they are currently operating under that identity. Furthermore, for an attacker to achieve full root-level access via group zero assignment, their process must have explicitly removed all supplementary groups using the privileged setgroups system call prior to triggering the vulnerability. Without this step, the bug would at worst result in the primary group being set to whatever ID was listed first among the user's existing supplementary groups, which may not confer significant privilege escalation depending on those specific group permissions.
This vulnerability is classified under CWE-841, Improper Enforcement of Behavioral Workflow, as it involves a failure in enforcing correct state transitions during credential manipulation due to outdated logic handling data structure changes. From an ATT&CK perspective, this aligns with Tactic TA0003 Persistence and potentially TA0005 Defense Evasion if used to bypass access controls, specifically mapping to techniques involving privilege escalation through misconfigured system policies or exploitation of kernel-level logical flaws in mandatory access control systems.
Mitigation strategies primarily involve applying vendor-provided patches that correct the group_is_primary function to properly reference the new dedicated field for primary group identifiers rather than relying on legacy array indexing assumptions. System administrators should ensure their FreeBSD 15.0 installations are updated with the latest security fixes addressing this credential handling defect. Additionally, reviewing and tightening MAC policy rulesets can reduce exposure by ensuring that critical transitions explicitly define target groups, thereby bypassing the code path where the incorrect inference logic is triggered. Restricting access to privileged system calls like setgroups for untrusted processes also limits the ability of attackers to manipulate supplementary group lists in ways that facilitate exploitation of this specific logical flaw.