Race Condition in Shared Memory Page Size Configuration

The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been configured without holding the rangelock. Two concurrent callers could both observe an unconfigured object and set conflicting page sizes, leaving the object in an inconsistent state. An unprivileged local user can exploit this race to escalate privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-58094 is a race condition vulnerability in the FIOSSHMLPGCNF ioctl operation that handles page size configuration for large-page shared memory objects. The vulnerability exists because the handler checks whether a page size has already been configured without holding the necessary rangelock—a synchronization primitive that prevents concurrent access. This allows two or more unprivileged local users to simultaneously observe an unconfigured object and set conflicting page sizes, leaving the shared memory object in an inconsistent state. This matters because it can lead to memory corruption, denial of service, or privilege escalation depending on how the application uses the affected shared memory. Any system running vulnerable kernel versions with unprivileged user access is at risk, particularly multi-user systems or containerized environments where local isolation is assumed.

Casky's 224 mapped skills help practitioners identify the exploitation patterns associated with this vulnerability by analyzing behaviors linked to MITRE ATT&CK technique TA0004 (Privilege Escalation). The platform's Claude AI with extended reasoning can detect indicators such as: repeated or concurrent ioctl calls to FIOSSHMLPGCNF with suspicious timing patterns, shared memory objects exhibiting inconsistent state flags, abnormal memory allocation failures following page size configuration, or unexpected kernel error messages in audit logs. Practitioners would observe findings highlighting suspicious process behavior around shared memory initialization, anomalous system call sequences indicating race condition exploitation attempts, and memory access patterns that deviate from normal large-page object lifecycle. By correlating these behavioral signals against the 754 security skills, Casky enables teams to distinguish between legitimate concurrent memory operations and active exploitation attempts, providing actionable intelligence for incident response and threat hunting.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-58094.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-58094

Casky has 224 skills that investigate the attack patterns behind CVE-2026-58094. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn