CVE-2026-58086

The record

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.

Affected packages

Related vulnerabilities

• CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote… CWE-273
• CVE-2026-61897 An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops… CWE-273
• CVE-2026-49421 The kernel function that implements unlinkat(2) and funlinkat(2) validated the… CWE-273
• CVE-2026-0099 In onNullBinding of HostEmulationManager.java, there is a possible way to launch an… CWE-273
• CVE-2026-44073 Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of… CWE-273
• CVE-2026-32107 xrdp is an open source RDP server. CWE-273
• CVE-2026-21882 theshit is a command-line utility that automatically detects and fixes common mistakes in… CWE-273
• GHSA-2j3p-gqw5-g59j theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command… CWE-273