---
id: CVE-2026-58100
title: >-
  kqueue_fork_copy_knote() indexed into the child's file descriptor table using
  a knote's file descriptor number without a bounds check
summary: >-
  kqueue_fork_copy_knote() indexed into the child's file descriptor table using
  a knote's file descriptor number without a bounds check.  Because the child's
  table is copied before knotes are transferred, a concurrent thread in the
  parent …
severity: none
cwe:
  - CWE-125
  - CWE-362
vendor: FreeBSD
product: FreeBSD
affected:
  - FreeBSD >= 15.1-RELEASE < p4
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:18:02.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58100'
references:
  - url: 'https://security.freebsd.org/advisories/FreeBSD-SA-26:65.kqueue.asc'
    label: secteam@freebsd.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T06:56:27.294Z'
---

## Overview

kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.  Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read.

An unprivileged local user may be able to exploit these races to escalate privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.