CVE-2026-58089 hwpmc fails to detach PMCs during exec credential transitions
Unprivileged users can monitor setuid processes via PMCs due to a kernel logic error, potentially leaking sensitive information or aiding privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58089?
CVE-2026-58089 is a high-severity vulnerability in Freebsd Freebsd, published on 26 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly.
An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.
Weakness: CWE-273
Which versions are affected by CVE-2026-58089?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-58089?
No fix has been published for CVE-2026-58089 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58089 being exploited?
There is no known exploitation of CVE-2026-58089 in the wild and no public exploit code.