CVE-2026-58086 Details
Description
As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:53.ktrace.asc | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-273 | Improper Check for Dropped Privileges | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freebsd freebsd | 15.0 - 15.0 p1 15.0 p10 15.0 p11 15.0 p2 15.0 p3 15.0 p4 15.0 p5 15.0 p6 15.0 p7 15.0 p8 15.0 p9 15.1 - 15.1 p1 15.1 rc2 15.1 rc3-p1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 31, 2026 | Initial Analysis | [email protected] |
| Aug 27, 2026 | CVE Modified | [email protected] |
| Aug 27, 2026 | CVE Modified | CISA-ADP |
| Aug 19, 2026 | New CVE Received | [email protected] |