Executive brief
A security flaw in FreeBSD's Capsicum sandboxing framework allows restricted programs to bypass security boundaries. Normally, a sandboxed application is prevented from interacting with other parts of the system, but this bug allows a compromised program to send signals to other processes. This could allow an attacker to shut down critical services or interfere with other applications running on the same system.
Technical details
The sigqueue(2) system call in FreeBSD was incorrectly permitted in Capsicum capability mode without an accompanying check to restrict signal delivery to the calling process's own PID. While kill(2) is properly restricted, the kern_sigqueue implementation lacked the necessary 'cap_mode' validation. A local attacker executing within a Capsicum sandbox can exploit this to send signals (such as SIGKILL or SIGSTOP) to any process they would normally have Unix permissions to signal. This effectively bypasses the process isolation guarantees provided by the Capsicum framework. The issue is resolved in FreeBSD 15.0-p10, 14.4-p6, and 14.3-p15.
Affected products
- FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15, 15.1-RELEASE before RC3-p1
Timeline
- 2026-05-29: patched: Initial correction in stable branches
- 2026-06-09: advisory: FreeBSD Project releases security advisory FreeBSD-SA-26:28.capsicum
- 2026-06-27: disclosed: CVE-2026-45259 published