Executive brief
A vulnerability in the FreeBSD Linuxulator, a component that allows Linux applications to run on FreeBSD, could allow a local user to gain elevated system privileges. The flaw occurs because the system fails to properly restrict dangerous environment variables when launching certain high-privilege Linux programs. An attacker with local access can exploit this to execute arbitrary code with the permissions of a set-user-ID or set-group-ID binary, potentially leading to a full system compromise.
Technical details
A privilege escalation vulnerability exists in the FreeBSD Linuxulator (linux.ko/linux64.ko) due to an incorrect check of the P_SUGID process flag during the execve(2) syscall. The kernel constructs the ELF auxiliary vector before the P_SUGID flag is set, causing the AT_SECURE flag to be incorrectly set to zero for set-user-ID and set-group-ID Linux executables. Consequently, the Linux runtime linker (glibc) does not disable security-sensitive environment variables like LD_PRELOAD. A local, unprivileged attacker can exploit this to inject a malicious shared library into a privileged Linux binary and execute code with elevated privileges. The issue is resolved in FreeBSD 15.0-RELEASE-p10, 14.4-RELEASE-p6, and 14.3-RELEASE-p15.
Affected products
- FreeBSD FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15
Timeline
- 2026-06-09: patched: Fixes committed to stable and release branches
- 2026-06-09: advisory: FreeBSD-SA-26:30.linux published
- 2026-06-27: disclosed: CVE-2026-49413 published to NVD