FreeBSD CVE-2026-45251

Exploitation requires the attacker to already have unprivileged local code execution on the FreeBSD host (no remote vector; CVSS is AV:L/PR:L). The concrete trigger is a race: one thread must be blocked in poll(2) or select(2) waiting on a file descriptor while another thread concurrently closes that descriptor, and the descriptor must be one of the specific file-descriptor types whose teardown path fails to unlink blocked threads from the wait queue before freeing the object. Limiting factors: the attacker needs a valid local account or foothold, must win a timing race between the wakeup and the free, and typically must control kernel heap layout to reallocate the freed object usefully - hence SSVC marks it not automatable. It does not require pre-existing elevated privileges, user interaction, or any non-default configuration; the vulnerable code is part of the standard kernel on unpatched 14.3, 14.4, and 15.0 releases.

The signals point to a serious but not urgent-at-internet-scale issue. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, High) shows a local-only attack requiring some (low) privileges but with full confidentiality, integrity, and availability impact - consistent with a local-user-to-root escalation. SSVC reinforces this: Technical Impact is 'total,' but Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no,' meaning it cannot be trivially mass-exploited and requires a per-target local foothold. EPSS is very low at 0.02% (5th percentile), and there is no CISA KEV listing, so there is no evidence of active exploitation. These signals are internally consistent, not conflicting: high host-level impact and clear exploitability for a local attacker, but low probability of widespread automated abuse because the attacker must already have local code execution. This is a real patch priority for multi-user, shared, or container/jail-host FreeBSD systems where untrusted local users exist, and a lower priority for single-tenant appliances where no untrusted local access is available. Note the description states superuser privileges can be obtained but does not include an independent public reliability assessment - treat weaponization difficulty as inferred from the UAF class, not confirmed.

An unprivileged local user (for example a low-privilege shell account, a compromised service account, or code running inside a jail on a shared host) runs a program that blocks a thread in poll(2) or select(2) on a specific descriptor type, then closes that descriptor from another thread to trigger freeing of the still-referenced object. By grooming the kernel heap so the freed object is reallocated with attacker-controlled contents before the blocked thread is woken, the attacker turns the use-after-free into kernel memory corruption and escalates to superuser (root). No public exploit is identified at time of analysis, and SSVC rates the flaw as not automatable, so exploitation requires targeted, per-host effort.