ByteOS Network

CVE Vulnerability Details :

CVE-2026-5398

PUBLISHED

More Info Official Page

Assigner-freebsd

Assigner Org ID-63664ac6-956c-4cba-a5d0-f46076e16109

Published At-22 Apr, 2026 | 02:23

Updated At-23 Apr, 2026 | 03:56

▼CVE Numbering Authority (CNA)

Kernel use-after-free bug in the TIOCNOTTY handler

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory. A malicious process can abuse the dangling pointer to grant itself root privileges.

Affected Products

Vendor

FreeBSD Foundation

Product

FreeBSD

Modules

Default Status

unknown

Versions

Affected

From 15.0-RELEASE before p6 (release)
From 14.4-RELEASE before p2 (release)
From 14.3-RELEASE before p11 (release)
From 13.5-RELEASE before p12 (release)

Problem Types

Type	CWE ID	Description
CWE	CWE-416	CWE-416: Use After Free

Type: CWE

CWE ID: CWE-416

Description: CWE-416: Use After Free

Credits

finder

Nicholas Carlini using Claude, Anthropic

References

Hyperlink	Resource
https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc	vendor-advisory

Hyperlink: https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.4

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References