CVE-2026-58091

HighCVSS 7.8/10Last modified Sep 24, 2026

Description

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.

On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580928.1In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first el CVE-2026-580937.0The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did n CVE-2026-580947.8The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately CVE-2026-580958.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint o CVE-2026-580968.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersiz CVE-2026-580977.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command inter CVE-2026-580988.4When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number CVE-2026-580997.0When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list tr CVE-2026-58103.5A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the compo CVE-2026-581007.0kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Beca CVE-2026-581017.5Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL CVE-2026-581029.1Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When b