Severity: Unknown
Affected Package: kernel/tty
Summary: Use-after-free via tty ioctls (CVE-2026-58093)
The tty subsystem manages terminal devices and their associated state. The TIOCSCTTY ioctl(2) operation allows a session leader to make a terminal its controlling terminal. In tty_generic_ioctl() (sys/kern/tty.c), the TIOCSCTTY handler drops the tty lock so that it can acquire proctree_lock in the correct order, then simply calls tty_lock() again. Nothing was revalidated after relocking, so a terminal that was being destroyed during that window could still be linked into the calling process' session, leaving a freed tty reachable through it. The TIOCSPGRP handler relocked the same way. It rechecked tty_is_ctty(), but that does not detect a device that has gone away. An unprivileged local user can race this to trigger a use-after-free in the kernel, which may be leveraged for privilege escalation.
No specific recommendations provided.
Aliases: CVE-2026-58093
Published: August 26, 2026
Last Modified: August 26, 2026