CVE-2026-58083

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue&amp;#39;s active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races.<br /> <br /> An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.