FreeBSD CVE-2026-58090

Exploitation requires an unprivileged local user account with the ability to create AF_UNIX SOCK_STREAM sockets, which is a default capability on all standard FreeBSD multi-user installations - no special kernel option, non-default compile flag, or specific service needs to be running. The CVSS PR:L confirms a non-root authenticated local session is the minimum requirement; fully remote or unauthenticated exploitation is not possible. The vulnerability is triggered through error paths in the SOCK_STREAM control message receive path, meaning the attacker must craft socket operations that cause the kernel to enter those error paths. Exploitation is strictly limited to local access vectors. The primary limiting factor is the requirement for any form of local shell or code execution on the target system; environments where all local accounts are trusted, or where interactive login is disabled for all non-root users, have a significantly reduced realistic attack surface.

The CVSS 3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the threat profile: a non-root local user account is sufficient, and attack complexity is genuinely low once shell access is available. The EPSS score of 0.16% at the 6th percentile indicates the vulnerability has not attracted significant exploitation activity in the broader ecosystem at time of analysis, and there is no CISA KEV listing. However, the gap between EPSS and real-world risk should be noted - EPSS reflects observed exploitation telemetry, and a kernel privilege escalation bug with AC:L can transition rapidly from no-known-exploit to weaponized once a POC circulates. There is no confirmed active exploitation, but any multi-user FreeBSD 15.x environment - shared hosting, containerized infrastructure, or managed servers where untrusted users hold local accounts - faces a credible internal threat, since successful exploitation yields full C:H/I:H/A:H system compromise. The S:U (scope unchanged) metric confirms impact is bounded to the compromised system itself, which limits lateral movement risk slightly. Overall: high patch priority for multi-user FreeBSD 15.x deployments despite low current EPSS.

An unprivileged attacker with a local shell on a vulnerable FreeBSD 15.x system opens an AF_UNIX SOCK_STREAM socket pair and sends crafted data with control messages designed to trigger the error path in the kernel receive handler, inducing a free of the control message mbufs while they remain referenced in the receive socket buffer. By controlling allocation timing and reusing the freed mbuf memory with attacker-controlled data, the attacker achieves kernel-level read/write primitives and escalates to root. No public POC has been identified at time of analysis, but the AC:L rating indicates the technique does not require precise heap-spray timing or environment-specific conditions.