CVE-2026-58098High· 8.4▾ TwilightWhen semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 8.4
none → high
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, the counter wraps around, and semop(2) may falsely conclude that the original set still exists. The subsequent access to a semaphore within the set may then be out of bounds.
An unprivileged local user can trigger an out-of-bounds access on kernel heap memory, potentially leading to privilege escalation.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101310High· 7.0The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101307High· 8.2When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
CVE-2026-58096High· 8.8LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717
CVE-2026-101309High· 7.0The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101311High· 7.0The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
CVE-2026-101308Medium· 5.5When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer