CVE-2026-58098

Name of the Vulnerable Software and Affected Versions NetApp Products (affected versions not specified)

Description An issue exists in the semop(2) function where it releases the per-set lock and sleeps while waiting for a semaphore condition. Upon waking, the function uses a 15-bit sequence number embedded in the semaphore set's IPC identifier to verify if the set was removed. If a large number of semaphore sets are created and destroyed in the same table slot during this sleep period, the counter can wrap around. This causes semop(2) to incorrectly assume the original set still exists, leading to an out-of-bounds access on kernel heap memory. An unprivileged local user could exploit this to achieve privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.