Executive brief
A vulnerability in the FreeBSD operating system's debugging facilities could allow a local user to gain full administrative control of the system. By exploiting a flaw in how the system handles certain requests to monitor or control other programs, an attacker can execute unauthorized code directly within the system's core (the kernel). This bypasses standard security boundaries, even if the attacker is using a standard, non-privileged account.
Technical details
A vulnerability exists in the FreeBSD ptrace(2) system call, specifically within the PT_SC_REMOTE operation. The kernel fails to properly validate parameters when executing syscall(2) and __syscall(2) meta-system calls on behalf of a debugger. A local, unprivileged attacker with the ability to debug a process (even one without special privileges) can exploit this lack of validation to trigger an out-of-bounds write (CWE-787) or similar memory corruption in the kernel. This leads to arbitrary code execution in kernel mode, resulting in full system compromise and privilege escalation. The issue is resolved in FreeBSD 15.0-RELEASE-p9, 14.4-RELEASE-p5, and 14.3-RELEASE-p14.
Affected products
- FreeBSD Project FreeBSD 15.0-RELEASE before p9, 14.4-RELEASE before p5, 14.3-RELEASE before p14, and all supported versions prior to correction date 2026-05-20
Timeline
- 2026-05-20: patched: Fixes committed to stable and release branches.
- 2026-05-20: advisory: FreeBSD-SA-26:21.ptrace published.
- 2026-05-21: disclosed: CVE-2026-45253 published to NVD.