CVE-2026-58092

Name of the Vulnerable Software and Affected Versions FreeBSD version 15.0

Description A change in the kernel structure for user credentials caused the group is primary() function to be improperly updated. This function is utilized by mac do to determine the primary group ID of a credential after applying a transition rule when the target does not explicitly specify a group. Consequently, specific mac do rules can be abused to incorrectly set the primary group ID to the value stored in the first element of the original credential's supplementary group array. If the supplementary group list is empty, the primary group ID may be set to 0 (the wheel group), potentially allowing for privilege escalation to root depending on the system configuration. To trigger this, the rule must apply to the caller, and the process must typically remove all supplementary groups using the setgroups(2) system call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.