high8.4
CVE-2026-5398
The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session.
Impact
The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory. A malicious process can abuse the dangling pointer to grant itself root privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freebsd | Freebsd | Versions 13.5, 14.3, 14.4, 15.0 |