FreeBSD Kernel up to p1/p7/p11 System V Semaphore semctl out-of-bounds

Summaryinfo

A vulnerability was found in FreeBSD Kernel up to p1/p7/p11. It has been classified as very critical. This affects the function semctl of the component System V Semaphore. The manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-58087. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in FreeBSD Kernel up to p1/p7/p11 and classified as very critical. This issue affects the function semctl of the component System V Semaphore. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.

It is possible to read the advisory at security.freebsd.org. The identification of this vulnerability is CVE-2026-58087 since 06/29/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/19/2026).

Upgrading to version p2, p8 or p12 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-62364). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• FreeBSD

Name

• Kernel

Version

• p1
• p7
• p11

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion