Executive brief
A security flaw in the FreeBSD operating system allows a local user to disable a key memory protection feature called Address Space Layout Randomization (ASLR) for programs that run with elevated (setuid) privileges. While this bug does not allow an attacker to break into a system directly, it significantly simplifies the process of exploiting other existing software vulnerabilities to gain full administrative control. Administrators should apply the latest kernel patches and reboot to restore these critical security protections.
Technical details
A vulnerability in the FreeBSD kernel's ELF image activator results in an incorrect execution order when handling setuid/setgid binaries. The kernel clears per-process ASLR preference flags (set via procctl(2)) after the PIE (Position-Independent Executable) base address has already been computed, rather than before. Consequently, an unprivileged local user can call procctl(2) to disable randomization and then execute a setuid binary via execve(2), resulting in a predictable memory layout for that privileged process. This bypasses a critical exploit mitigation and aids in the exploitation of separate memory corruption bugs. The issue is fixed in FreeBSD 15.0-RELEASE-p10, 14.4-RELEASE-p6, and 14.3-RELEASE-p15.
Affected products
- FreeBSD Project FreeBSD 15.0-RELEASE before p10, 14.4-RELEASE before p6, 14.3-RELEASE before p15
Timeline
- 2026-06-09: advisory: FreeBSD Project released advisory FreeBSD-SA-26:32.elf
- 2026-06-09: patched: Fixes committed to stable and release branches
- 2026-06-27: disclosed: CVE-2026-49414 published to NVD