CVE-2026-58099 | BDVDB-2026-389754 Detail

Description#

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-15Record published in the CVE List.
2. Version 22026-10-19Most recent update recorded in the CVE List.