CVE-2026-58100

The FreeBSD kernel is vulnerable to a memory safety issue in the kqueue copy-on-fork implementation. Specifically, the kqueue_fork_copy_knote() function performs an out-of-bounds read because it indexes into the child's file descriptor table using a knote's file descriptor number without a proper...

CVE-2026-58100 Memory safety bugs in kqueue copy-on-fork implementation

kqueueforkcopyknote indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file...

CVE-2026-58100 Memory safety bugs in kqueue copy-on-fork implementation

kqueueforkcopyknote indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file...

CVE-2026-58099

The FreeBSD operating system (specifically versions 15.1 , 15.1-STABLE , and 15.1-RELEASE-p4 ) is vulnerable to a memory safety bug in the kqueue copy-on-fork implementation. The root cause is a race condition where the copy code fails to exclude internal marker knotes before marking them as in-f...

CVE-2026-58099 Memory safety bugs in kqueue copy-on-fork implementation

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent...

CVE-2026-58099 Memory safety bugs in kqueue copy-on-fork implementation

When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent...

FreeBSD : FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation (d725b228-bccc-11f1-906f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d725b228-bccc-11f1-906f-bc241121aa0a advisory. When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude...

FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation

Problem Description: When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was droppe...

FreeBSD-SA-26:65.kqueue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:65.kqueue Security Advisory The FreeBSD Project Topic: Memory safety bugs in kqueue copy-on-fork implementation Category: core Module: kqueue Announced:...

FreeBSD Security Advisory - FreeBSD-SA-26:65.kqueue

FreeBSD Security Advisory - Memory safety bugs in kqueue copy-on-fork implementation. An unprivileged local user may be able to exploit these races to escalate privileges...

CVE-2026-58083 Use-after-free in kqueue copy-on-fork

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

FreeBSD : FreeBSD -- Use-after-free in kqueue copy-on-fork (a4e4a74c-8bb7-11f1-a6ab-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a4e4a74c-8bb7-11f1-a6ab-bc241121aa0a advisory. While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be...

FreeBSD-SA-26:50.kqueue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:50.kqueue Security Advisory The FreeBSD Project Topic: Use-after-free in kqueue copy-on-fork Category: core Module: kqueue Announced: 2026-07-29 Credits:...

FreeBSD -- Use-after-free in kqueue copy-on-fork

Problem Description: While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the acti...