Executive brief
A security flaw in the FreeBSD operating system allows a standard user to send signals to processes they should not have access to, including those owned by other users or the system administrator (root). By exploiting this, an attacker can force critical system services to stop or restart, leading to a complete system shutdown or service outage. This bypasses security boundaries, including those intended to isolate 'jailed' environments from the rest of the system.
Technical details
The thr_kill2(2) system call in FreeBSD, used for delivering signals to specific threads, fails to properly validate the return value of the p_cansignal() permission check. While the check is performed, the signal is delivered regardless of whether the check succeeded or failed. A local attacker can exploit this by brute-forcing globally sequential thread IDs to target processes outside their own privilege level or jail container. This allows the delivery of signals like SIGKILL or SIGSTOP to arbitrary processes, including those owned by root, leading to a Denial of Service (DoS). The issue is resolved in FreeBSD 15.0-RELEASE-p10, 14.4-RELEASE-p6, and 14.3-RELEASE-p15.
Affected products
- FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15
Timeline
- 2026-06-09: patched: Correction committed to FreeBSD source branches.
- 2026-06-09: advisory: FreeBSD Security Advisory SA-26:25.thr published.
- 2026-06-26: disclosed: CVE-2026-45256 published.