Quick answers
- Is CVE-2026-58089 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58089 being exploited in the wild.
- How severe is CVE-2026-58089?
- High severity, with a CVSS score of 7.8, published 26 August 2026.
- Which products and versions are affected?
- Freebsd All supported versions (14.x, 15.x).
- Is there a fix for CVE-2026-58089?
- A patch was published on 2026-08-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58089 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-58089?
- Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the hwpmc(4) driver's handling of credential transitions during execve(2) calls. When a process executes a setuid or setgid binary, hwpmc should detach performance monitoring counters (PMCs) attached by unprivileged users; however, an inverted conditional check causes this detachment logic to fail. An unprivileged local user can attach PMCs to a process they own, and after that process executes a setuid/setgid binary, the attacker retains the ability to monitor performance data that should no longer be accessible. This is a local privilege escalation requiring no special privileges to attach PMCs initially, but it violates the intended security boundary between privilege levels. Patches are available for all supported FreeBSD branches (14.4, 15.0, 15.1).
Affected products
- FreeBSD FreeBSD All supported versions (14.x, 15.x)
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched