« Volver al listado

CVE-2026-58094

Estado: AnalizadaAlta (7.8)—

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.

An unprivileged local user can exploit this race to escalate privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de race condition (CWE-367) en ioctl local sin UI requerida (PR:L, AV:L) que permite escalada de privilegios en FreeBSD mediante estado inconsistente de objetos de memoria compartida.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramOperating System ConfigurationExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Freebsd — Freebsd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-58094",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-58094",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-26T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secteam@freebsd.org",
      "affectedData": [
        {
          "vendor": "FreeBSD",
          "modules": [
            "posixshm"
          ],
          "product": "FreeBSD",
          "versions": [
            {
              "status": "affected",
              "version": "15.1-RELEASE",
              "lessThan": "p3",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "15.0-RELEASE",
              "lessThan": "p13",
              "versionType": "release"
            },
            {
              "status": "affected",
              "version": "14.4-RELEASE",
              "lessThan": "p9",
              "versionType": "release"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-08-26T06:16:26.350",
  "references": [
    {
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:63.posixshm.asc",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secteam@freebsd.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secteam@freebsd.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.  This is intended to be used immediately after creating the object, before any memory is allocated for the object.  The handler checked whether a page size had already been configured without holding the rangelock.  Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.\n\nAn unprivileged local user can exploit this race to escalate privileges."
    }
  ],
  "lastModified": "2026-09-24T13:17:24.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9CC0037-3282-42C3-80D8-F6C1D43B9332"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53D73FD2-4B06-47D3-BA2A-4363E9DE3565"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D726890B-E679-43A9-A211-D5C05BBE3941"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBE94635-5277-4050-8098-F062091F6596"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A66308E4-DA6E-48DB-86E5-A503EE110EAD"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59EF67B4-E572-483B-BC9E-B2D3D8DF19CE"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:14.4:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B47E6FB0-4176-449D-9955-09A236E9F5BC"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA4AAA57-70A7-4717-ACF2-A253E757FF2C"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "683CEB32-A634-4363-86FB-2BDC59724E3E"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EC8EE3F-9992-4A0F-A0CD-3B44BA086BD2"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC1797AB-83A6-4379-865F-8AD495EACEEC"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E24ABFA6-4D12-4DE5-832B-438502C7D188"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C9869C-494B-4628-9AA3-4AA5B989C377"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "002AA2FE-C7BA-471A-9434-0E56A878ACBF"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B187670D-E3A2-4A0D-A653-982F8B447E78"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "047E7EE9-FB51-4CF2-A8BE-484BFD819565"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C9768AE-9954-4B2A-9525-D7D4942406E7"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8B9EF55-3755-452A-B067-043803099B22"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE3C4F40-A117-4B37-8CDD-096A1A763630"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E379873C-DA04-4EAA-ABF6-EB87B4B471A8"
            },
            {
              "criteria": "cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "044A3D39-A2AF-499C-8434-0A07B5854661"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secteam@freebsd.org"
}