Description

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races. An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-19T08:17:12.470Z",
  "pubdate": "2026-08-19T08:17:12.470Z",
  "executiveSummary": "This vulnerability involves a race condition and list corruption flaw occurring within the kernel during the process of copying knotes during a fork operation. Specifically, a knote utilizing a timer-based filter can fire asynchronously and become enqueued on the kqueue's active list before the copy routine completes its execution.\nThe copy routine fails to account for this concurrent enqueuing, resulting in the new knote being enqueued a second time, which corrupts the active list structure. Furthermore, the copy routine omits holding the appropriate locks while reading the knote state, thereby enabling additional race conditions.\nAn unprivileged local user can successfully trigger this use-after-free condition within the kernel, potentially leading to local privilege escalation and compromising system integrity. Exploitation requires local system access to execute crafted system calls that induce the race condition during fork execution.",
  "technicalDetails": "The vulnerability resides in the kernel's knote and kqueue management subsystem, specifically within the routine responsible for duplicating knotes during a fork system call. The vulnerable component fails to properly synchronize state access and lock acquisition during the duplication phase.\nThe root cause is twofold: first, the copy routine does not hold the appropriate locks while reading the knote state, exposing internal data structures to concurrent modifications. Second, a timer-based filter knote can trigger asynchronously while the copy operation is ongoing. Because the kernel fails to check or handle this state, the active knote is prematurely or redundantly enqueued onto the kqueue's active list.\nStep-by-step, the exploitation flow occurs as follows: 1) An unprivileged local user initiates a process fork while active timer-based knotes are registered on a kqueue. 2) As the kernel's copy routine iterates over and duplicates the knotes, a timer expires, causing the knote with the timer-based filter to fire. 3) The firing knote places itself onto the kqueue's active list concurrently with the ongoing copy routine. 4) The copy routine subsequently processes and re-enqueues the same knote, leading to list corruption due to duplicate node insertion. 5) The resulting memory and list corruption introduces a use-after-free condition within the kernel memory management structures.\nPost-exploitation impact includes kernel memory corruption, arbitrary code execution within ring 0, and subsequent local privilege escalation allowing an unprivileged user to gain full administrative control over the affected system."
}