Executive brief
FreeBSD 15.0 changed how user credentials are handled internally, but a function used by the mac_do permission framework was not properly updated. This bug allows certain unprivileged users to incorrectly set their primary group ID to "wheel" (group 0) when using specific mac_do rules, potentially enabling unauthorized privilege escalation on systems that use group 0 membership to grant elevated privileges.
Technical details
A logic error in the group_is_primary() function within FreeBSD 15.0's kernel credential subsystem causes it to read the primary group ID from the wrong location after a credential structure refactoring. When mac_do applies a transition rule (such as "uid=1001>uid=1002") that does not explicitly specify a target group, the function incorrectly retrieves the group ID from the first element of the supplementary group array instead of the dedicated primary group ID field. An attacker with a matching source UID can exploit this to set their primary group ID to 0 (wheel) if they have first removed themselves from all supplementary groups via setgroups(2). Depending on system configuration, membership in group 0 may grant root-equivalent privileges, enabling full privilege escalation. The vulnerability requires a matching mac_do rule and local system access.
Affected products
- FreeBSD FreeBSD 15.0
Timeline
- 2026-08-26: disclosed