What is the CVSS score of CVE-2026-45251?

CVE-2026-45251 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD are affected by CVE-2026-45251?

FreeBSD kernel versions 14.3, 14.4, and 15.0 contain a local privilege escalation vulnerability (CVE-2026-45251) enabling unprivileged local users to gain superuser privileges.

How to fix or mitigate CVE-2026-45251?

Within 24 hours: Inventory all systems running FreeBSD kernel 14.3, 14.4, or 15.0 and identify unprivileged user accounts with local access capability. Within 7 days: Monitor FreeBSD security advisories daily for patch availability; implement temporary access restrictions to unprivileged user accounts if operationally feasible. Within 30 days: Apply vendor patch immediately upon release, or execute migration plan to unaffected FreeBSD release branches.

FreeBSD CVE-2026-45251

EUVD-2026-31256 HIGH

Use After Free (CWE-416)

2026-05-21 freebsd

GHSA-wp9w-fp98-2cxm

Memory Corruption Information Disclosure Use After Free Freebsd

7.8

CVSS 3.1 · Vendor: freebsd

Severity by source

Vendor (freebsd) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Unprivileged local user (PR:L, AV:L) triggering a UAF that yields root gives full C/I/A impact; scope unchanged as it stays within the OS security authority.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (freebsd).

CVSS VectorVendor: freebsd

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:32 vuln.today

CVE Published

May 21, 2026 - 09:04 nvd

UNKNOWN (no severity yet)

CVE Published

May 21, 2026 - 09:04 cve.org

HIGH 7.8

DescriptionCVE.org

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object.

In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability.

The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges.

AnalysisAI

Local privilege escalation in the FreeBSD kernel (14.3, 14.4, and 15.0 release branches) lets an unprivileged local user obtain superuser privileges through a use-after-free in the poll(2)/select(2) subsystem. When a file descriptor is closed while a thread is still blocked waiting on it, certain descriptor types fail to unlink the sleeping thread from the object's wait queue before the object is freed, so the later wakeup dereferences freed kernel memory. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, but technical impact is rated total.

Technical ContextAI

The flaw lives in FreeBSD's event-notification path for the classic synchronous multiplexing syscalls poll(2) and select(2). A thread that blocks in these calls registers itself on a per-object (per-file-descriptor) wait queue but, by design, does not hold its own reference on the underlying file/object. The kernel is therefore responsible for detaching any sleeping threads from that wait queue when the backing object is destroyed. For some descriptor types the teardown path omits this unlink step, leaving a dangling wait-queue entry that points at memory returned to the allocator. This is a textbook CWE-416 (Use After Free): the freed object is later touched when the blocked thread is woken, and because it is kernel-controlled memory the condition is corruptible into a write/control primitive. The affected component is the base FreeBSD operating system kernel, identified in CPE data as cpe:2.3:a:freebsd:freebsd, i.e. the OS itself rather than a third-party package.

RemediationAI

Upgrade to the fixed patch level for your release branch: FreeBSD 14.3-RELEASE-p14, FreeBSD 14.4-RELEASE-p5, or FreeBSD 15.0-RELEASE-p9, per the vendor advisory FreeBSD-SA-26:19.file (https://security.freebsd.org/advisories/FreeBSD-SA-26:19.file.asc). Apply via freebsd-update fetch/install (binary update) or by rebuilding the kernel from the corresponding security branch, then reboot, since this is a kernel-space fix and a running system remains vulnerable until the new kernel is loaded. If immediate patching is not possible, the practical compensating control is to reduce untrusted local access to affected hosts: restrict shell/login access, avoid running untrusted code, and on multi-tenant systems limit or isolate untrusted users, jails, and containers that share the vulnerable kernel - the trade-off is operational disruption to legitimate multi-user workloads, and note there is no kernel toggle that disables poll(2)/select(2) without breaking normal applications, so these controls are containment rather than a true fix. Prioritize reboots on shared, multi-user, and jail-host systems where local attackers are plausible.