FreeBSD CVE-2026-58087

Local shell access on the target FreeBSD system is required - this vulnerability cannot be triggered remotely. System V semaphore support must be enabled in the running kernel, which is true of the default FreeBSD kernel configuration (SYSVSEM option). The attack requires the attacker to be able to create and destroy semaphore sets, which is permitted to unprivileged users by default (no CAP_IPC_OWNER or equivalent privilege needed). The core timing requirement - completing 32,768 semaphore set destroy/create cycles while racing a concurrent GETALL or SETALL operation at the correct moment - limits reliability on heavily loaded or low-frequency systems. The official CVSS vector's UI:R flag suggests the vulnerable GETALL or SETALL call may need to be issued by a second concurrent process, which could mean exploitability depends on a victim process performing semaphore operations; this should be confirmed against the vendor advisory. Remote exploitation, container escape without an existing local foothold, and exploitation without System V IPC support are not possible.

The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a high-severity local privilege escalation accessible to unprivileged users. The PR:N metric is consistent with the description's explicit statement that an unprivileged local user can trigger the flaw. However, the AC:L (low complexity) rating appears optimistic: the exploit requires cycling the sequence counter through exactly 32,768 destroy/recreate iterations while race-timing a concurrent GETALL or SETALL call, which is sensitive to system load and scheduling jitter - AC:H may be more representative in practice. The UI:R metric is unusual for a kernel race condition and is not clearly explained by the description; it may reflect that the vulnerable GETALL or SETALL must execute in a separate concurrent process, which is a limiting factor and should be verified against FreeBSD-SA-26:54.sysvsem directly. This CVE is not listed in the CISA KEV catalog, and no public PoC has been identified, moderating immediacy. Risk is highest on multi-tenant FreeBSD deployments - shared hosts, jail-based infrastructure, or FreeBSD-based container platforms - where untrusted local users exist. Fully network-isolated, single-user systems carry substantially lower real-world risk.

An unprivileged local attacker opens two threads: thread A sits in a tight loop destroying and recreating a System V semaphore set at a fixed array index, cycling through 32,768 iterations to wrap the kernel's 15-bit sequence counter back to its original value but with a set containing a different number of semaphores. Thread B repeatedly calls semctl(GETALL) timed to hit the brief post-wrap window before the validation check, causing the kernel to copy values using a buffer allocated for the original count into a set of a different size - writing past the end of the heap buffer. The resulting heap corruption is then leveraged through standard kernel exploitation techniques (e.g., overwriting adjacent kernel objects or function pointers) to achieve root or kernel code execution. No public proof-of-concept code has been identified at time of analysis.