CVE-2026-58091— Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
Quick assessment
Affected
FreeBSD FreeBSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
该 ioctl 的实现尝试在同步组中对所有通道获取锁。如果锁定某个通道会导致阻塞，它会释放同步组列表锁并进入睡眠状态。当重新被唤醒时，同步组结构可能已被释放，但该实现未对此情况进行处理。 在多音频设备的系统上，本地未授权用户可利用此使用后释放（use-after-free）漏洞实现权限提升。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-58091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
Source: CVE Program / CVE List V5
Vulnerability Description
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.
On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-58091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58091
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-58091 (1)
Same Patch Batch · FreeBSD · 2026-08-26 · 9 CVEs total
| CVE-2026-58090 | Use-after-free in unix SOCK_STREAM message handling | |
| CVE-2026-58092 | Unauthorized credential switching | |
| CVE-2026-58089 | hwpmc fails to detach PMCs during exec credential transitions | |
| CVE-2026-58097 | ppp(8): missing length validation in mp_SetEnddisc() | |
| CVE-2026-58095 | ppp(8): incorrect length calculation in mp_Enddisc() | |
| CVE-2026-58093 | Kernel use-after-free via tty ioctls | |
| CVE-2026-58096 | ppp(8): missing length validation in LcpDecodeConfig() | |
| CVE-2026-58094 | TOCTOU race in POSIX shared memory large page configuration |
IV. Related Vulnerabilities
Same product: FreeBSD
-
CVE-2026-58094
TOCTOU race in POSIX shared memory large page configuration -
CVE-2026-58093
Kernel use-after-free via tty ioctls -
CVE-2026-58097
ppp(8): missing length validation in mp_SetEnddisc() -
CVE-2026-58096
ppp(8): missing length validation in LcpDecodeConfig() -
CVE-2026-58095
ppp(8): incorrect length calculation in mp_Enddisc()
Same vendor: FreeBSD
-
CVE-2026-58094
TOCTOU race in POSIX shared memory large page configuration -
CVE-2026-58093
Kernel use-after-free via tty ioctls -
CVE-2026-58097
ppp(8): missing length validation in mp_SetEnddisc() -
CVE-2026-58096
ppp(8): missing length validation in LcpDecodeConfig() -
CVE-2026-58095
ppp(8): incorrect length calculation in mp_Enddisc()
Same weakness: CWE-416
V. Comments for CVE-2026-58091
No comments yet