Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2026-5398

Kernel use-after-free bug in the TIOCNOTTY handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
freebsd

Description

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory. A malicious process can abuse the dangling pointer to grant itself root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeBSD FreeBSD

Default version status: unknown

  • 15.0-RELEASE to < p6affected
  • 14.4-RELEASE to < p2affected
  • 14.3-RELEASE to < p11affected
  • 13.5-RELEASE to < p12affected

References