CVE-2026-58089 — hwpmc fails to detach PMCs during exec credential transitions

CVE-2026-58089

hwpmc fails to detach PMCs during exec credential transitions PUBLISHED

Description (CNA)

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p3; affected 15.0-RELEASE before p13; affected 14.4-RELEASE before p9

CWE

CWE-273

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.