CVE-2026-58092 Unauthorized credential switching

In FreeBSD 15.0+ , the mac_do MAC policy module contains a bug in the group_is_primary() function that was not updated after a kernel credential structure change (primary GID moved to a dedicated field). When a mac_do transition rule does not explicitly specify a target group, the primary group I...

FreeBSD -- Unauthorized credential switching

Problem Description: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This...