{"id":183167,"date":"2026-08-28T16:53:41","date_gmt":"2026-08-28T14:53:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimosti-v-linux-i-freebsd-pozvolyayushhie-poluchit-root-dostup-v-sisteme"},"modified":"2026-08-28T16:53:43","modified_gmt":"2026-08-28T14:53:43","slug":"linux-and-freebsd-vulnerabilities-allowing-root-access","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/linux-and-freebsd-vulnerabilities-allowing-root-access","title":{"rendered":"Vulnerabilities in Linux and FreeBSD that allow root access to the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Eight vulnerabilities have been fixed in FreeBSD that could allow privilege escalation in the system. The vulnerabilities have been addressed in updates for FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13, and 14.4-RELEASE-p9.   <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-58094 \u2014 race condition in the implementation of the FIOSSHMLPGCNF ioctl operation, used for configuring the page size of shared memory. The issue is caused by the lack of a lock during the resize check operation, allowing incorrect object parameters to be set by sending two concurrent requests with different sizes.\n<li class=\"l\"> CVE-2026-58093 \u2014 memory access after it has been freed in the implementation of ioctl TIOCSCTTY, used for managing the pseudo-terminal. The issue is due to incorrect handling of locks.\n<li class=\"l\"> CVE-2026-58095, CVE-2026-58096, CVE-2026-58097 \u2014 issues in the implementation of the PPP (Point-to-Point Protocol) caused by improper size checks of the processed parameters.\n<li class=\"l\"> CVE-2026-58092 \u2014 logical error in the mac_do module, which provides functionality for executing commands as another user. The issue is due to a change in how user permission information is stored \u2014 the primary group ID was moved to a separate structure, but the change was not reflected in the group_is_primary() function, which continued to retrieve information using the old offset.\n<li class=\"l\"> CVE-2026-58091 \u2014 memory access after it has been freed in the implementation of ioctl SNDCTL_DSP_SYNCSTART, used to synchronize playback across multiple sound devices. The vulnerability arises from improper handling of locks and manifests on systems with multiple sound devices.\n<li class=\"l\"> CVE-2026-58090 \u2014 memory access after it has been freed in the implementation of UNIX sockets, occurring during the processing of SOCK_STREAM messages.\n<li class=\"l\"> CVE-2026-58089 \u2014 logical error in the hwpmc driver, which is intended for performance monitoring, causing the collection of statistics to not be disabled after privilege escalation when running suid root processes. This issue allows a regular user to monitor activity in privileged processes.\n<li class=\"l\"> CVE-2026-18798, CVE-2026-54874, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076 \u2014 vulnerabilities in the openssl library, caused by buffer overflow, double free, string formatting issues, and NULL pointer dereference. Potentially, some of these issues may allow remote code execution.    <\/ul>\n<p>Several dangerous issues that allow a local user to gain root privileges have also been identified in the Linux kernel:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-53361 \u2014 use-after-free vulnerability in the AF_UNIX sockets implementation. An exploit has been publicly released that allows escaping from an isolated container. The exploit has been demonstrated on Ubuntu 24.04, RHEL 10, and Debian 13 with Linux kernels 6.8, 6.12, 6.14, and 6.17. The issue has been fixed in kernel updates 7.1.0, 6.18.38, 6.12.95, and 6.6.144.\n<li class=\"l\"> CVE-2026-72137 \u2014 double free vulnerability in the nat_keepalive module. The issue is present starting from kernel 6.11 and has been fixed in releases 7.2.0, 6.12.101, 6.18.40, and 7.1.5. A working exploit has been publicly released that allows gaining root privileges on the system.\n<li class=\"l\"> Vulnerabilities (CVE not assigned) in the eCryptfs filesystem that could potentially lead to kernel-level code execution when processing specially crafted encrypted files.\n<li class=\"l\"> Vulnerability (CVE not assigned) in the ntfs3 module that allows the substitution of an executable file with the suid root bit when mounting a specially crafted filesystem image (an example of exploiting the vulnerability to gain root access during the automount of a USB drive is shown).\n<li class=\"l\"> A total of 1668 vulnerabilities in the Linux kernel have been disclosed in August.    <\/ul>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66158\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u043e FreeBSD \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13 \u0438 14.4-RELEASE-p9. CVE-2026-58094 &#8212; \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 ioctl-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 FIOSSHMLPGCNF, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0440\u0430\u0437\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u043c\u0435\u0440\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0434\u0432\u0443\u0445 \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183167","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u043e FreeBSD \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13 \u0438 14.4-RELEASE-p9.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/linux-and-freebsd-vulnerabilities-allowing-root-access\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0438 FreeBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u043e FreeBSD \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13 \u0438 14.4-RELEASE-p9.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/linux-and-freebsd-vulnerabilities-allowing-root-access\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-28T14:53:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-08-28T14:53:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilities in Linux and FreeBSD that allow gaining root access to the system | ProHoster","description":"Eight vulnerabilities have been fixed in FreeBSD that could allow privilege escalation in the system. The vulnerabilities have been addressed in updates for FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13, and 14.4-RELEASE-p9.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/linux-and-freebsd-vulnerabilities-allowing-root-access","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0438 FreeBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412\u043e FreeBSD \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 FreeBSD 15.1-RELEASE-p3, FreeBSD 15.0-RELEASE-p13 \u0438 14.4-RELEASE-p9.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/linux-and-freebsd-vulnerabilities-allowing-root-access","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-28T14:53:41+00:00","article:modified_time":"2026-08-28T14:53:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183167","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-31 11:53:09","updated":"2026-08-31 11:53:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/183167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=183167"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/183167\/revisions"}],"predecessor-version":[{"id":183168,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/183167\/revisions\/183168"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=183167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=183167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=183167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}