CVE-2026-58087
Heap out-of-bounds access in semctl(2)
Description
The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.
INFO
Published Date :
Aug. 19, 2026, 8:17 a.m.
Last Modified :
Oct. 27, 2026, 12:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update the kernel to the latest version.
- Reboot the system after updates.
- Verify semaphore set handling is fixed.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-58087.
| URL | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc | Vendor Advisory Mailing List |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-58087 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-58087
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-58087 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-58087 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 27, 2026
Action Type Old Value New Value Added Translation Title: FreeBSD, Description: Los comandos GETALL y SETALL en semctl(2) registraron el número de semáforos en el conjunto objetivo, liberaron el bloqueo que protegía el conjunto, asignaron un búfer dimensionado para esa cantidad y volvieron a adquirir el bloqueo. Se utilizó una verificación de número de secuencia para verificar que el conjunto no había sido reemplazado en el ínterin, pero el número de secuencia se reinicia después de 0x8000 ciclos de creación/destrucción. Al destruir y recrear rápidamente conjuntos de semáforos en el mismo índice, otro proceso puede hacer que el número de secuencia se reinicie, permitiendo que un conjunto con un número diferente de semáforos pase la validación. La copia subsiguiente entonces lee o escribe más allá del final del búfer asignado. Un usuario local sin privilegios puede desencadenar lecturas y escrituras fuera de límites en la memoria del heap del kernel, lo que podría conducir a una escalada de privilegios. -
Initial Analysis by [email protected]
Aug. 31, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:-:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* *cpe:2.3:o:freebsd:freebsd:15.1:rc3-p1:*:*:*:*:*:* Added Reference Type FreeBSD: https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc Types: Mailing List, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 20, 2026
Action Type Old Value New Value Changed SSVC {'id': 'CVE-2026-58087', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-19T11:47:43.787285Z'} {'id': 'CVE-2026-58087', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-19T00:00:00+00:00'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 19, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added SSVC {'id': 'CVE-2026-58087', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-19T11:47:43.787285Z'} -
New CVE Received by [email protected]
Aug. 19, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'FreeBSD', 'modules': ['sysvsem'], 'product': 'FreeBSD', 'versions': [{'status': 'affected', 'version': '15.1-RELEASE', 'lessThan': 'p2', 'versionType': 'release'}, {'status': 'affected', 'version': '15.0-RELEASE', 'lessThan': 'p12', 'versionType': 'release'}, {'status': 'affected', 'version': '14.4-RELEASE', 'lessThan': 'p8', 'versionType': 'release'}], 'defaultStatus': 'unknown'}] Added Description The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation. Added CWE CWE-125 Added CWE CWE-787 Added CWE CWE-191 Added Reference https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.asc