CVE-2026-58094High· 7.8▾ TwilightThe FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked w…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.1%
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.
An unprivileged local user can exploit this race to escalate privileges.
freebsd = 14.4freebsd = 15.0freebsd = 15.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101308Medium· 5.5When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer
CVE-2026-101309High· 7.0The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101310High· 7.0The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101311High· 7.0The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
CVE-2026-101307High· 8.2When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
CVE-2026-101305High· 8.8renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments