Use-after-free in unix SOCK_STREAM message handling
Priority LOW 35CWE-416Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00153 4th percentileScored 2026-11-07
Fix Fixed FreeBSD (FreeBSD): p3, p13
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeBSD | FreeBSD | 15.1-RELEASE to before p3; 15.0-RELEASE to before p13 | p3, p13 | Patch available | CNA |
- FreeBSD VendorFreeBSD Affected 15.1-RELEASE to before p3; 15.0-RELEASE to before p13 Fixed in p3, p13 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* | 15.0 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* | 15.0 p10 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* | 15.0 p11 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:* | 15.0 p12 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* | 15.0 p2 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* | 15.0 p3 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* | 15.0 p4 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* | 15.0 p5 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* | 15.0 p6 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* | 15.0 p7 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* Versions 15.0 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p10:*:*:*:*:*:* Versions 15.0 p10 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p11:*:*:*:*:*:* Versions 15.0 p11 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p12:*:*:*:*:*:* Versions 15.0 p12 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* Versions 15.0 p2 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* Versions 15.0 p3 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* Versions 15.0 p4 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* Versions 15.0 p5 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* Versions 15.0 p6 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* Versions 15.0 p7 Vulnerable ·FreeBSD
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* | 15.0 p8 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* | 15.0 p9 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* | 15.1 p1 | Vulnerable | FreeBSD |
| cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* | 15.1 p2 | Vulnerable | FreeBSD |
- cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* Versions 15.0 p8 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* Versions 15.0 p9 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.1:p1:*:*:*:*:*:* Versions 15.1 p1 Vulnerable ·FreeBSD
- cpe:2.3:o:freebsd:freebsd:15.1:p2:*:*:*:*:*:* Versions 15.1 p2 Vulnerable ·FreeBSD
Remediation
- Fix · CNA FreeBSD (FreeBSD) Fixed in p3, p13
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
FreeBSD p13, p3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-41842 Unauthorized credential switchingPriority LOW 37
Timeline
- 2026-10-02 Threatist record created from CVE-2026-58090
- 2026-10-03 Alias added: GHSA-35mj-6q95-hqwx
References
More Freebsd vulnerabilities
- TI-2011-04182 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT… CVSS 2.0HIGH 10.0
- TI-2007-03684 Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows… CVSS 3.1CRITICAL 9.8
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2003-00642 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-58090 · CVE Program
- CVE-2026-58090 · NVD
- FIRST EPSS
- GHSA-35mj-6q95-hqwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences