---
id: CVE-2026-58091
title: >-
  The implementation of this ioctl attempts to acquire locks on all channels in
  a sync group
summary: >-
  The implementation of this ioctl attempts to acquire locks on all channels in
  a sync group.  If locking a channel would block, it releases the sync group
  list lock and sleeps.  Upon reawakening, it is possible that the sync group
  structu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: freebsd
product: freebsd
affected:
  - freebsd = 14.4
  - freebsd = 15.0
  - freebsd = 15.1
published: '2026-08-26'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T13:55:22.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58091'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:58.sound.asc'
    label: secteam@freebsd.org
tags:
  - nvd
epss: 0.00154
epssPercentile: 0.03773
ingestedAt: '2026-09-24T14:44:21.306Z'
---

## Overview

The implementation of this ioctl attempts to acquire locks on all channels in a sync group.  If locking a channel would block, it releases the sync group list lock and sleeps.  Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.

 On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.

## Affected

- `freebsd = 14.4`
- `freebsd = 15.0`
- `freebsd = 15.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.