TOCTOU race in POSIX shared memory large page configuration
FreeBSD-SA-26:63.posixshm · CVE-2026-58094
Our decision for FreeSense
FreeBSD corrected this on 2026-08-25, after the FreeBSD source pin of FreeSense 1.0 (pinned 2026-08-03). The fix arrives with the next FreeBSD pin of each line that is still updated. No one has checked yet whether FreeSense is exposed in practice.
- Advisory: corrected 2026-08-25
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | Open | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available.
What FreeBSD says
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state.
Impact
An unprivileged local user can exploit this race to escalate privileges.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.