CVE-2026-58087

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The GETALL and SETALL commands in the semctl() function contain a flaw in how they handle semaphore sets. The process records the number of semaphores, releases the protecting lock, allocates a buffer, and then reacquires the lock. While a sequence-number check is used to ensure the set was not replaced, this number wraps after 0x8000 create and destroy cycles. A local unprivileged user can rapidly destroy and recreate semaphore sets at the same index to cause this wrap, bypassing validation and triggering out-of-bounds reads and writes on kernel heap memory, which may lead to privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.