IT SBIT Services
Schneeberger
DEEN
CVE tracker

FreeBSD: Heap out-of-bounds access in semop(2)

CVE-2026-58098High 8.4

← All vulnerabilities

Summary

The System V semaphore code in the FreeBSD kernel uses a 15-bit sequence number to detect whether a semaphore set was removed while semop(2) was blocked. If many sets are created and destroyed in the same table slot during that time, the counter can wrap around and the kernel may wrongly assume the set still exists. A local, unprivileged user can then trigger an out-of-bounds access in kernel heap memory, which may lead to privilege escalation to root.

Affected

  • FreeBSD 15.1-RELEASE before p4
  • FreeBSD 15.0-RELEASE before p14
  • FreeBSD 14.5-RELEASE before p1
  • FreeBSD 14.4-RELEASE before p10
  • The vendor advisory states that all supported FreeBSD versions are affected. Default configuration: unknown.

Fixed in

  • stable/15 and 15.1-STABLE: commit 8063b1b61ae8
  • releng/15.1 and 15.1-RELEASE-p4: commit aff64c19ebb8
  • releng/15.0 and 15.0-RELEASE-p14: commit fc5c2fd47117
  • stable/14 and 14.5-STABLE: commit 04f841a05836
  • releng/14.5 and 14.5-RELEASE-p1: commit a412d0c46d36
  • releng/14.4 and 14.4-RELEASE-p10: commit 9bb6f92b5d1b
  • Fixed builds were published on 2026-09-29.

Workaround

No workaround is available according to the vendor advisory. Install the fix.

Exploitation

  • CISA SSVC: exploitation none, automatable no, technical impact total
  • Not in the CISA Known Exploited Vulnerabilities catalogue; EPSS below 1%
  • No public exploit known
  • No exploitation in the wild known

Our recommendation

  • Patch affected systems using freebsd-update or pkg upgrade from FreeBSD-base, then reboot.
  • Migrate any 15.0 system to a supported branch, because 15.0 reached end of life on 30 September 2026.
  • Until patched, restrict local shell and interactive accounts to trusted users.
  • Prioritise multi-user, shell, CI and jail hosts. Single-administrator systems still need patching.
  • Make sure all other FreeBSD sysvsem fixes, including FreeBSD-SA-26:54, are also installed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:24.

Original description (NVD)

When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds. An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed