FreeBSD CVE-2026-58083

The attacker must have an unprivileged interactive or programmatic local session on a FreeBSD 15.1-RELEASE system running a kernel earlier than patch level 2. Exploitation requires the ability to call fork() and create kqueue file descriptors with timer-based knote filters (EVFILT_TIMER), which are standard unprivileged system calls available by default - no special system configuration, non-default feature, or elevated group membership is required. The race is between the knote timer interrupt and the fork() knote copy path, so reliable exploitation depends on timing sensitivity (kernel scheduling, timer frequency, CPU count). Exploitation is limited to the local machine; there is no network-facing attack surface. The vulnerability does not affect FreeBSD 15.1-RELEASE-p2 or later. Status of other FreeBSD branches is unconfirmed from available data.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.4 and indicates a local, zero-privileges attack with no user interaction required and full confidentiality, integrity, and availability impact - consistent with a kernel privilege escalation. However, AC:L warrants scrutiny: the vulnerability is fundamentally a race condition between a timer interrupt and a fork() copy path, which typically implies timing sensitivity. This analyst assesses AC as more accurately H, lowering practical exploitability compared to the vendor rating. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at time of analysis. Despite the absence of observed exploitation, the primitive (kernel use-after-free yielding local root) is inherently dangerous on multi-tenant systems, shared hosting, or containerized environments where untrusted local users exist. FreeBSD 15.1-RELEASE prior to patch 2 is the sole confirmed affected version; older branches are not addressed by the available advisory data and their status is unknown.

A local unprivileged user on a FreeBSD 15.1-RELEASE system (before p2) creates a kqueue with one or more timer-based knotes, then repeatedly calls fork() in a tight loop to race the knote copy routine against the timer firing. When the timer fires mid-copy, the child knote is appended to the active list twice, corrupting the doubly-linked list structure; subsequent kernel traversal of the corrupted list dereferences a freed pointer. The attacker leverages the use-after-free to overwrite kernel memory - for example, a process credential structure - achieving root privileges. No public proof-of-concept has been identified, but the exploitation primitive is well-understood in the kernel security research community.