Local Privilege Escalation in FreeBSD Kernel (CVE‑2026‑58093) Enables TTY Race Condition Attack
What It Is — A race‑condition flaw in the FreeBSD kernel’s TIOCSCTTY handler (CVE‑2026‑58093) allows a low‑privileged attacker who can execute code locally to obtain full kernel privileges. The vulnerability stems from missing locking around TTY object operations, enabling an attacker to execute arbitrary code in kernel context. The issue carries a CVSS 7.8 (High) score (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). FreeBSD released an advisory and patch (FreeBSD‑SA‑26:62) on 29 Oct 2026.
Affected Products – FreeBSD operating system, kernel component.
Why It Matters for Trust & Control Assurance – The flaw highlights the need for robust privileged‑access controls and evidence of timely OS patching, a core control area across most compliance frameworks.
Recommended Actions –
- Deploy the FreeBSD‑SA‑26:62 update immediately.
- Verify that TTY handling is properly locked via a configuration review or code audit.
- Strengthen monitoring of privileged‑account activity and maintain audit logs of kernel‑level events.
Source: Zero Day Initiative advisory