CVE-2026-58089 — HIGH (7.8)

Vulnerability Description

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-273

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc

FAQ

What is CVE-2026-58089?

CVE-2026-58089 is a vulnerability with a CVSS score of 7.8 (HIGH). When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled pro...

How severe is CVE-2026-58089?

CVE-2026-58089 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-58089?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.