Executive brief
A vulnerability in the FreeBSD kernel allows a standard user to overwrite files they only have permission to read. By sending a file to themselves over a local network connection using specific kernel features, an attacker can trick the system into writing new data directly into the file's permanent storage. This can be used to modify critical system files, such as the 'su' command, to grant the attacker full administrative (root) control over the server.
Technical details
A 'write-what-where' condition exists in the FreeBSD Kernel TLS (KTLS) implementation. When KTLS receive (RX) is enabled on a loopback TCP socket, the kernel attempts to decrypt incoming TLS records in-place within mbufs. If the sender uses sendfile(2) to transmit data, the mbufs may reference the physical page cache of the underlying file (M_EXTPG or EXT_SFBUF). Because the decryption occurs directly on these file-backed pages via the direct map (DMAP), the plaintext overwrites the original file content in the page cache and is subsequently flushed to disk. An attacker can bypass file system permissions and immutable flags (schg) to modify sensitive binaries like /usr/bin/su. The vulnerability affects systems where kern.ipc.mb_use_ext_pgs is enabled (default on amd64, arm64, and riscv).
Affected products
- FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15, 13.0 through 13.4
- MidnightBSD MidnightBSD 4.0+
Timeline
- 2026-05-13: other: Reported to FreeBSD security team
- 2026-06-09: patched: Correction committed to FreeBSD branches
- 2026-06-09: advisory: FreeBSD-SA-26:26.ktls published
- 2026-06-26: disclosed: CVE-2026-45257 published to NVD