CVE-2026-58086

EUVD-2026-62340
As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user.  Tracing configured by a jailed root user was therefore not flagged as privileged.

An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright.  A jailed root user therefore cannot reliably trace unprivileged processes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.41%
Affected Products (NVD)
VendorProductVersion
freebsdfreebsd
15.0
freebsdfreebsd
15.0:p1
freebsdfreebsd
15.0:p10
freebsdfreebsd
15.0:p11
freebsdfreebsd
15.0:p2
freebsdfreebsd
15.0:p3
freebsdfreebsd
15.0:p4
freebsdfreebsd
15.0:p5
freebsdfreebsd
15.0:p6
freebsdfreebsd
15.0:p7
freebsdfreebsd
15.0:p8
freebsdfreebsd
15.0:p9
freebsdfreebsd
15.1
freebsdfreebsd
15.1:p1
freebsdfreebsd
15.1:rc2
freebsdfreebsd
15.1:rc3-p1
𝑥
= Vulnerable software versions