FreeBSD CVE-2026-58093

Exploitation requires a local, low-privileged user account on the target FreeBSD system (confirmed by CVSS PR:L). No network-level access, no specific service, and no administrator interaction are required. The race window is narrow and timing-dependent (CVSS AC:H), meaning the attacker must win a concurrent kernel scheduling race between the TIOCSCTTY ioctl path and a tty destruction path - exploitation may require repeated attempts. Exploitation is limited to FreeBSD systems running affected kernel versions (15.0-RELEASE before p13, 15.1-RELEASE before p3, 14.4-RELEASE before p9); it does not apply to Linux, macOS, or other BSDs unless they share an identical ioctl locking pattern. Multi-tenant or shared-hosting deployments where untrusted users hold shell accounts represent the primary risk population.

CVSS 3.1 scores this at 7.0 (High) with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and that assessment is internally consistent: local access with a low-privileged account is required, but the high attack complexity (AC:H) honestly reflects the race condition's timing dependency. EPSS stands at 0.13% (3rd percentile), indicating the research and threat-actor community has not yet operationalised this vulnerability at scale - this is not in CISA KEV. The combination of AC:H and low EPSS suggests exploitation is technically possible but unreliable in practice, requiring either a timing-favorable environment or repeated attempts. Despite the C:H/I:H/A:H impact triad, real-world priority should be tempered: an attacker must already have a local shell account on the target FreeBSD system, which significantly limits the exposed attack surface to multi-tenant or shared-hosting deployments. The discrepancy between the cveorg and EUVD reference advisories (SA-26:60 vs. SA-26:62, both claiming to address tty) is a minor data inconsistency worth verifying against the vendor's published advisory index.

An attacker with a low-privileged local shell account on a multi-user FreeBSD system spawns two concurrent threads: one repeatedly invokes TIOCSCTTY on a target tty device while the second concurrently closes and destroys that device. When the kernel's tty lock is transiently dropped for process-tree lock acquisition, the attacker wins the race, causing the kernel to attach a partially-destroyed tty object to their session, which corrupts kernel session state in a way that can be leveraged to escalate to root. No public proof-of-concept code has been identified at time of analysis, so reliable exploitation requires knowledge of FreeBSD kernel internals and race-window tuning.