---
id: CVE-2026-58100
title: >-
  kqueue_fork_copy_knote() indexed into the child's file descriptor table using
  a knote's file descriptor number without a bounds check
summary: >-
  kqueue_fork_copy_knote() indexed into the child's file descriptor table using
  a knote's file descriptor number without a bounds check.  Because the child's
  table is copied before knotes are transferred, a concurrent thread in the
  parent …
severity: high
cwe:
  - CWE-125
  - CWE-362
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p4
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:41.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58100'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T06:56:27.294Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T03:56:56.154892Z'
epss: 0.001
epssPercentile: 0.00834
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
---

## Overview

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.