Description
The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.

An unprivileged local user can exploit this race condition to escalate privileges.
Published: 2026-08-26
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the handling of the TIOCSCTTY ioctl, where the tty lock is released to obtain the process tree lock and is not correctly revalidated upon reacquisition. This race condition allows a local attacker to link a terminal that is concurrently being destroyed to the victim process's session, effectively creating a use‑after‑free scenario. An unprivileged user can exploit this flaw to elevate privileges on the system.

Affected Systems

The vulnerability affects the FreeBSD operating system. Specific version information is not disclosed in the advisory.

Risk and Exploitability

No CVSS score or EPSS value is publicly available, but the described privilege escalation indicates a high impact risk. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation is reported yet, yet the severity of the flaw warrants vigilance and prompt remediation.

Generated by OpenCVE AI on August 26, 2026 at 06:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch or security update for the kernel when it becomes available.
  • If a patch is not yet available, temporarily disable or reduce the use of TTY devices that rely on the problematic ioctl to limit attack surface.
  • Regularly monitor local user activity for abnormal tty session behaviors and apply security updates as soon as they are released.

Generated by OpenCVE AI on August 26, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Freebsd
Freebsd freebsd
Vendors & Products Freebsd
Freebsd freebsd

Wed, 26 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
References

Wed, 26 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Description The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session. An unprivileged local user can exploit this race condition to escalate privileges.
Title Kernel use-after-free via tty ioctls
Weaknesses CWE-362
CWE-416
References

Subscriptions

Freebsd Freebsd
cve-icon MITRE

Status: PUBLISHED

Assigner: freebsd

Published:

Updated: 2026-08-26T05:40:30.824Z

Reserved: 2026-06-29T01:40:17.498Z

Link: CVE-2026-58093

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T06:16:26.227

Modified: 2026-08-26T06:16:26.227

Link: CVE-2026-58093

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T07:00:15Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free