Executive brief
A vulnerability in the FreeBSD operating system kernel could allow a local user to gain full administrative (superuser) control of the system. The issue occurs when the system handles certain background tasks related to monitoring files or processes, leading to a memory error. An attacker with basic access to the system can trigger this error to bypass security restrictions and take over the machine.
Technical details
A use-after-free vulnerability exists in the FreeBSD kernel when handling poll(2) or select(2) system calls. When a file descriptor is closed while a thread is blocked waiting on it, the kernel may fail to unlink the blocked thread from the underlying object's wait queue before freeing that object. Because the blocked thread does not hold a reference to the object, the object is deallocated; when the thread is later woken, it accesses the now-freed memory. This flaw can be triggered by unprivileged local users to achieve arbitrary code execution in kernel mode and obtain superuser privileges. The issue affects multiple file descriptor types, including process descriptors.
Affected products
- FreeBSD Project FreeBSD 15.0-STABLE, 15.0-RELEASE before p9, 14.4-STABLE, 14.4-RELEASE before p5, 14.3-RELEASE before p14
Timeline
- 2026-05-20: patched: Fixes committed to stable and release branches.
- 2026-05-20: advisory: FreeBSD-SA-26:19.file published.
- 2026-05-21: disclosed: CVE-2026-45251 published.