Vulnerability Details CVE-2026-58099
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory.
An unprivileged local user may be able to exploit these races to escalate privileges.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 3.0%
CVSS Severity
CVSS v3 Score 7.0