CVE-2026-58086

HighCVSS 8.1/10Last modified Oct 27, 2026

Description

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged.

An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-273

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	>= 15.1-RELEASE, < p2; >= 15.0-RELEASE, < p12

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:53.ktrace.ascVendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Oct 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580877.8The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, alloca CVE-2026-580887.4The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterate CVE-2026-580897.8When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An CVE-2026-58097.1The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-s CVE-2026-580907.8The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before process CVE-2026-580917.8The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases t CVE-2026-580928.1In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first el CVE-2026-580937.0The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did n CVE-2026-580947.8The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately CVE-2026-580958.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint o CVE-2026-580968.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersiz CVE-2026-580977.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command inter