---
id: CVE-2026-58090
title: >-
  The SOCK_STREAM receive path in the unix socket implementation failed to fully
  detach control messages from the socket buffer before processing them
summary: >-
  The SOCK_STREAM receive path in the unix socket implementation failed to fully
  detach control messages from the socket buffer before processing them.  Some
  error paths would free those messages, leaving freed data mbufs in the receive
  so…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: freebsd
product: freebsd
affected:
  - freebsd = 15.0
  - freebsd = 15.1
published: '2026-08-26'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:01:08.893'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58090'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:57.unix.asc'
    label: secteam@freebsd.org
tags:
  - nvd
epss: 0.00154
epssPercentile: 0.03773
ingestedAt: '2026-09-24T14:44:21.305Z'
---

## Overview

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them.  Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.

An unprivileged local user can exploit this use-after-free to escalate privileges.

## Affected

- `freebsd = 15.0`
- `freebsd = 15.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.