The vulnerability of the ioctl request handler TIOCSCTTY in FreeBSD operating systems allows a attacker to increase their privileges.

The vulnerability of the ioctl request handler TIOCSCTTY in FreeBSD operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-58093

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-58093

The FreeBSD kernel contains a use-after-free vulnerability in the tty module's TIOCSCTTY ioctl handler. The issue stems from a race condition where the handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the lock. This allows a...

CVE-2026-58093 Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

CVE-2026-58093 Kernel use-after-free via tty ioctls

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

EUVD-2026-66250

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

PT-2026-81936

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

FreeBSD : FreeBSD -- Kernel use-after-free via tty ioctls (a34b5154-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a34b5154-a0ff-11f1-ae1f-bc241121aa0a advisory. The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After...

CVE-2026-58093: Concurrent Execution using Shared Resource with Improper Synchronization

The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An...

FreeBSD-SA-26:62.tty

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:62.tty Security Advisory The FreeBSD Project Topic: Kernel use-after-free via tty ioctls Category: core Module: tty Announced: 2026-08-25 Credits: tsune of...

EUVD-2002-1473

Malware in sbrugna...

CVE-2002-1490

CVE-2002-1490 affects NetBSD 1.4–1.6 beta. The vulnerability is triggered by a sequence of TIOCSCTTY ioctl calls that overrun a structure counter, resetting it to zero and freeing memory still in use, leading to a local denial of service via kernel panic. The connected documents confirm the issue...

CVE-2002-1490: Undefined Security Weakness

NetBSD 1.4 through 1.6 beta allows local users to cause a denial of service kernel panic via a series of calls to the TIOCSCTTY ioctl, which causes an integer overflow in a structure counter and sets the counter to zero, which frees memory that is still in use by other processes...

NetBSD Security Advisory 2002-007: Repeated TIOCSCTTY ioctl can corrupt session hold counts

-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2002-007 ================================= Topic: Repeated TIOCSCTTY ioctl can corrupt session hold counts Version: NetBSD-current: source prior to July 21, 2002 NetBSD-1.6 beta: source prior to July 23, 2002 NetBSD-1.5.: source prior to...