CVE-2026-58094

HighCVSS 7.8/10Last modified Sep 24, 2026

Description

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.

An unprivileged local user can exploit this race to escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580958.8mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint o CVE-2026-580968.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersiz CVE-2026-580977.8mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command inter CVE-2026-580988.4When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number CVE-2026-580997.0When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list tr CVE-2026-58103.5A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the compo CVE-2026-581007.0kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Beca CVE-2026-581017.5Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL CVE-2026-581029.1Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When b CVE-2026-581062.0CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() hel CVE-2026-581075.5CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcin CVE-2026-581081.2The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQL