CVE-2026-58087

The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.

• CWE-125
• CWE-191
• CWE-787

• https://security.freebsd.org/advisories/FreeBSD-SA-26:54.sysvsem.ascVendor Advisory, Mailing List

Published

Aug 19, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58081Several encoding modules, including HZ, UTF-7, VIQR, and ZW,…9.8
• CVE-2026-58082The ISO-2022 encoding module used a stack buffer sized to MB…9.8
• CVE-2026-58083While the kernel was copying knotes during fork, a knote wit…8.4
• CVE-2026-58084To retrieve the previous timer value, the kernel calls realt…5.5
• CVE-2026-58085After dispatching a decrypt operation to OCF and receiving t…7.5
• CVE-2026-58086As an inadvertent side effect of an unrelated code change, P…8.1
• CVE-2026-58088The ELF core dump code counted the number of dumpable VM map…7.4
• CVE-2026-58089When a process calls execve(2) to execute a setuid or setgid…7.8
• CVE-2026-5809The wpForo Forum plugin for WordPress is vulnerable to Arbit…7.1
• CVE-2026-58090The SOCK_STREAM receive path in the unix socket implementati…7.8
• CVE-2026-58091The implementation of this ioctl attempts to acquire locks o…7.8
• CVE-2026-58092In FreeBSD 15.0, the kernel structure used to represent user…8.1