kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• vendor FreeBSD FreeBSDversion unspecified

How to fix CVE-2026-58100

• Recommended remediation

  A patch or advisory reference is linked. Open the original publisher for availability by product version.

• Official advisories

  • CIRCL Vulnerability Lookup · vulnerability.circl.lu
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • FreeBSD Security · freebsd.org
  • NIST NVD · nvd.nist.gov

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 15, 2026 · NIST NVD

   Detected

   kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l

2. Oct 15, 2026 · NIST NVD

   Updated

   kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l

3. Oct 16, 2026 · NIST NVD

   Updated

   kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l

Sources

• CIRCL Vulnerability LookupVulnerability recordCVE-2026-58100

  kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register k

  vulnerability.circl.lu
• CVE.orgVulnerability recordCVE-2026-58100

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-58100

  30-day exploitation probability 0.1%

  first.org
• FreeBSD SecurityVendor advisoryCVE-2026-58100

  CVE-2026-58100 is named by FreeBSD Security.

  freebsd.org
• NIST NVDVulnerability recordCVE-2026-58100

  kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register

  nvd.nist.gov

References

• Reference · security.freebsd.org

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.