Executive brief
FreeBSD's terminal device management subsystem contains a race condition in the TIOCSCTTY ioctl handler that allows an unprivileged local user to exploit improper lock handling and escalate privileges. An attacker can link a terminal being destroyed to their session, gaining unauthorized elevated access to the system.
Technical details
The vulnerability is a use-after-free race condition in the tty subsystem's TIOCSCTTY ioctl handler. The handler drops the tty lock to acquire the process tree lock, but upon reacquiring the tty lock, it fails to revalidate the terminal state. This allows an attacker to link a terminal that is concurrently being destroyed to their session. The vulnerability requires local access and no special privileges to trigger; an unprivileged user can exploit the timing window between lock release and reacquisition. Patches were released on 2026-08-25 for all supported FreeBSD versions (14.4, 15.0, and 15.1 release branches).
Affected products
- FreeBSD FreeBSD 14.4 before 14.4-RELEASE-p9, 15.0 before 15.0-RELEASE-p13, 15.1 before 15.1-RELEASE-p3
Timeline
- 2026-08-25: disclosed: FreeBSD Security Advisory SA-26:62 published
- 2026-08-25: patched: Patches released for stable/14, stable/15, releng/14.4, releng/15.0, and releng/15.1