CVE-2026-58099 — Memory safety bugs in kqueue copy-on-fork implementation
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them…
Published: 2026-10-15 · CVSS: 7.0 · CVSS 3.1
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these races to escalate privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7