CVE-2026-5398 Details
Description
The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory. A malicious process can abuse the dangling pointer to grant itself root privileges.
A use-after-free vulnerability has been identified in the FreeBSD kernel's TIOCNOTTY ioctl handler, affecting all supported FreeBSD versions. The issue arises because the handler fails to remove a back-pointer from the terminal structure to the session of the calling process. As a result, when the process exits, the terminal structure may reference freed memory. This dangling pointer can be exploited by a malicious process to gain root privileges.
Users can upgrade to a supported FreeBSD stable or release branch dated after the correction date and reboot the system. Instructions for updating via the pkg utility, freebsd-update utility, or by applying a source code patch are available in the FreeBSD Security Advisory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 13.5 - 13.5 beta3 13.5 p1 13.5 p10 13.5 p11 13.5 p2 13.5 p3 13.5 p4 13.5 p5 13.5 p6 13.5 p7 13.5 p8 13.5 p9 14.3 - 14.3 p1 14.3 p10 14.3 p2 14.3 p3 14.3 p4 14.3 p5 14.3 p6 14.3 p7 14.3 p8 14.3 p9 14.4 - 14.4 p1 14.4 rc1 15.0 - 15.0 p1 15.0 p2 15.0 p3 15.0 p4 15.0 p5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |