# CVE-2026-58092: FreeBSD kernel credential primary group ID incorrect in mac_do transition

Source: https://junglewise.ai/threats/cve-2026-58092-freebsd-kernel-credential-primary-group-id-incorrect-in-mac-do  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-58092 · Severity: high · CVSS 8.1 · Published 2026-08-26

FreeBSD 15.0 changed how user credentials are handled internally, but a function used by the mac_do permission framework was not properly updated. This bug allows certain unprivileged users to incorrectly set their primary group ID to "wheel" (group 0) when using specific mac_do rules, potentially enabling unauthorized privilege escalation on systems that use group 0 membership to grant elevated privileges.

Technologies: [Freebsd](https://junglewise.ai/threats/technologies/freebsd). Vendors: [Freebsd](https://junglewise.ai/threats/vendors/freebsd).

## Quick answers

**Is CVE-2026-58092 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58092 being exploited in the wild.

**How severe is CVE-2026-58092?** High severity, with a CVSS score of 8.1, published 26 August 2026.

**Which products and versions are affected?** Freebsd 15.0.

**Is there a fix for CVE-2026-58092?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58092 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-58092?** Check whether you run Freebsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic error in the group_is_primary() function within FreeBSD 15.0's kernel credential subsystem causes it to read the primary group ID from the wrong location after a credential structure refactoring. When mac_do applies a transition rule (such as "uid=1001>uid=1002") that does not explicitly specify a target group, the function incorrectly retrieves the group ID from the first element of the supplementary group array instead of the dedicated primary group ID field. An attacker with a matching source UID can exploit this to set their primary group ID to 0 (wheel) if they have first removed themselves from all supplementary groups via setgroups(2). Depending on system configuration, membership in group 0 may grant root-equivalent privileges, enabling full privilege escalation. The vulnerability requires a matching mac_do rule and local system access.

## Affected products

- FreeBSD FreeBSD 15.0

## Timeline

- 2026-08-26: disclosed

## Related threats

- [FreeBSD kqueue out-of-bounds read in fork copy](https://junglewise.ai/threats/cve-2026-58100-kqueue-fork-copy-knote-indexed-into-the-child-s-file-descriptor)
- [FreeBSD kernel kqueue memory safety bugs in copy-on-fork](https://junglewise.ai/threats/cve-2026-58099-when-copying-knotes-from-a-parent-kqueue-to-a-child-the-copy-code)
- [FreeBSD kernel heap out-of-bounds access in semop(2)](https://junglewise.ai/threats/cve-2026-58098-when-semop-2-blocks-waiting-for-a-semaphore-condition-it-releases)
- [FreeBSD sound(4) use-after-free in buffer resize TOCTOU race](https://junglewise.ai/threats/cve-2026-101308-when-an-audio-channel-s-buffer-needs-to-be-resized-the-sound-4)
- [FreeBSD RACK stack buffer overflow in tcp_rack](https://junglewise.ai/threats/cve-2026-101307-when-the-pcm-sample-array-needs-to-grow-the-rack-stack-doubles-a)