{"api_version":"1","generated_at":"2026-09-22T11:53:32+00:00","cve":"CVE-2026-58089","urls":{"html":"https://cve.report/CVE-2026-58089","api":"https://cve.report/api/cve/CVE-2026-58089.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-58089","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-58089"},"summary":{"title":"hwpmc fails to detach PMCs during exec credential transitions","description":"When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.  An inverted check meant that this scenario was not handled properly.\n\nAn unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.","state":"PUBLISHED","assigner":"freebsd","published_at":"2026-08-26 05:18:12","updated_at":"2026-08-26 16:54:50"},"problem_types":["CWE-273","CWE-273 CWE-273: Improper Check for Dropped Privileges"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}}],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc","name":"https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc","refsource":"secteam@freebsd.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58089","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58089","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.1-RELEASE p3 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.0-RELEASE p13 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 14.4-RELEASE p9 release","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Alexander Leidinger","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"58089","cve":"CVE-2026-58089","epss":"0.001190000","percentile":"0.019840000","score_date":"2026-08-27","updated_at":"2026-08-28 00:03:41"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-58089","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-26T15:23:48.918745Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-26T15:24:26.038Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","modules":["hwpmc"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p3","status":"affected","version":"15.1-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p9","status":"affected","version":"14.4-RELEASE","versionType":"release"}]}],"credits":[{"lang":"en","type":"finder","value":"Alexander Leidinger"}],"datePublic":"2026-08-25T19:45:00.000Z","descriptions":[{"lang":"en","value":"When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.  An inverted check meant that this scenario was not handled properly.\n\nAn unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-273","description":"CWE-273: Improper Check for Dropped Privileges","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-26T04:30:06.543Z","orgId":"63664ac6-956c-4cba-a5d0-f46076e16109","shortName":"freebsd"},"references":[{"tags":["vendor-advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:56.hwpmc.asc"}],"title":"hwpmc fails to detach PMCs during exec credential transitions","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"63664ac6-956c-4cba-a5d0-f46076e16109","assignerShortName":"freebsd","cveId":"CVE-2026-58089","datePublished":"2026-08-26T04:30:06.543Z","dateReserved":"2026-06-29T01:40:17.498Z","dateUpdated":"2026-08-26T15:24:26.038Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-26 05:18:12","lastModifiedDate":"2026-08-26 16:54:50","problem_types":["CWE-273","CWE-273 CWE-273: Improper Check for Dropped Privileges"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-26T15:23:48.918745Z","id":"CVE-2026-58089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"58089","Ordinal":"1","Title":"hwpmc fails to detach PMCs during exec credential transitions","CVE":"CVE-2026-58089","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"58089","Ordinal":"1","NoteData":"When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes.  An inverted check meant that this scenario was not handled properly.\n\nAn unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.","Type":"Description","Title":"hwpmc fails to detach PMCs during exec credential transitions"}]}}}