CVE-2026-7270: An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent

Executive brief

An operator precedence logic error in the FreeBSD kernel's execve(2) implementation leads to an incorrect buffer size calculation during argument restructuring. This results in a buffer overflow where attacker-controlled data can overwrite adjacent argument buffers in the kernel's exec_map, potentially allowing an unprivileged local user to obtain superuser privileges.

Affected products

• FreeBSD Project FreeBSD 15.0-RELEASE before p7, 14.4-RELEASE before p3, 14.3-RELEASE before p12, 13.5-RELEASE before p13

Timeline

• 2026-04-29: advisory: FreeBSD Security Advisory FreeBSD-SA-26:13.exec released.
• 2026-04-29: patched: Issue corrected in stable and release branches.
• 2026-04-30: disclosed: CVE-2026-7270 published.

References

• https://security.freebsd.org/advisories/FreeBSD-SA-26:13.exec.asc
• https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-freebsd
• https://news.ycombinator.com/item?id=48077971