{"id":"CVE-2026-58826","kind":"vulnerability","aliases":["CVE-2026-58826"],"related":[],"title":"Linux kernel: unshare use-after-free lets local user escalate privileges","description":"In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A use-after-free in the kernel's ksys_unshare routine in fork.c corrupts memory. A local user with no extra privileges can use it to gain higher privileges on the system.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","multi-user-hosts","self-hosted"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","triaged_at":"2026-11-02T20:39:09+00:00","updated_at":"2026-11-02T20:39:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T20:39:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: unshare use-after-free lets local user escalate privileges","impact":"high","summary":"A use-after-free in the kernel's ksys_unshare routine in fork.c corrupts memory. A local user with no extra privileges can use it to gain higher privileges on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","multi-user-hosts"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains root privileges on the machine","analyst_note":"Find affected kernel version ranges and the upstream fix commit from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-58826) and the kernel stable advisories.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"who_is_affected":"Systems running a Linux kernel that includes the ksys_unshare code in fork.c; the sources do not state affected kernel version ranges. Exposure requires a local account or code execution on the machine first, so multi-user hosts and shared servers matter most. unknown for the rest.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4080,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-58826':15A,18A 'addit':90C 'corrupt':44B,73C 'could':81C 'cve':13A,16A 'due':74C 'escal':11A,85C 'execut':91C 'exploit':100C 'extra':51B 'fork.c':43B,67C 'free':7A,34B,79C 'gain':57B 'higher':58B 'host':26B,29B 'infrastructur':19B 'interact':95C 'kernel':2A,22B,37B 'ksys':39B,64C 'lead':82C 'let':8A 'linux':1A,21B 'linux-kernel':20B 'local':9A,47B,84C 'memori':45B,72C 'multi':24B 'multi-user-host':23B 'need':93C,98C 'possibl':71C 'privileg':12A,52B,59B,87C,92C 'routin':41B 'self':28B 'self-host':27B 'system':62B 'unshar':3A,40B,65C 'use':5A,32B,54B,77C 'use-after-fre':4A,31B 'user':10A,25B,48B,94C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes the ksys_unshare code in fork.c; the sources do not state affected kernel version ranges. Exposure requires a local account or code execution on the machine first, so multi-user hosts and shared servers matter most. unknown for the rest.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","multiuserhosts","selfhosted","unknown"],"first_public_at":"2026-11-02T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-58826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58826","severity":null,"published_at":"2026-11-02T20:17:47+00:00","modified_at":"2026-11-02T20:17:47+00:00","first_seen_at":"2026-11-02T20:35:30+00:00","fetched_at":"2026-11-02T20:35:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}