CVE-2026-58099
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.
Risk Assessment
An unprivileged local user may be able to exploit these races to escalate privileges. Affects systems with a vulnerable kernel handling kqueue.
Recommendation
Update the system to a kernel version containing the fix that excludes marker knotes before marking in-flux and releasing the lock.
Other vulnerabilities in kqueue
Original NVD description (English source)
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS