FreeBSD CVE-2026-58086

Exploitation requires all of the following specific conditions: the attacker must be an existing user account inside a FreeBSD jail (not on the bare host or a different jail); the attacker must have been granted permission to debug the specific target process (e.g., via ptrace, a non-default privilege typically granted explicitly by jail or host administrator); the target host must be running FreeBSD 15.0-RELEASE before p12 or FreeBSD 15.1-RELEASE before p2; and jailed root must have an active ktrace session on that process. Exploitation is strictly limited to within the affected jail - the host system and sibling jails are unaffected. Deployments not using FreeBSD jails are entirely unaffected. Jails where unprivileged users are not granted debug/ptrace capabilities (the default hardened configuration) are not exploitable.

The NVD-assigned CVSS 3.1 score of 8.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H likely overstates practical severity because A:H is difficult to justify when the impact is confined to disabling tracing within a single jail rather than degrading the host system. The network attack vector is plausible if the attacker accesses the jail via SSH, but exploitation still requires holding debug permission over the specific target process - a non-default, administrator-granted capability. The EPSS score of 0.18% at the 8th percentile is consistent with a low-exploitation-probability privilege logic bug requiring specific jail conditions. There is no CISA KEV listing and no public POC. The primary real-world risk is to audit integrity: even a mid-sized municipal IT team in tczew running FreeBSD jail infrastructure for multi-tenant hosting or security-sensitive workloads should treat this as a priority maintenance patch rather than an emergency, particularly if ktrace is part of their incident response or compliance trail. CVSS overstates availability impact and the low EPSS corroborates that this is not being exploited opportunistically.

An attacker with an unprivileged user account inside a FreeBSD 15.x jail who has been granted debug access to a target process recognizes that jailed root's ktrace session on that same process is not marked privileged due to the PRIV_KTRACE regression. The attacker issues a ktrace flag modification call to clear or alter the jailed root's trace configuration, silently disabling audit capture for that process without triggering a privilege denial. No public exploit code or POC has been identified at time of analysis.