FreeBSD Kernel CVE-2026-45257

FreeBSD's kernel TLS (kTLS) subsystem offloads TLS record encryption and decryption into the kernel for performance. The sendfile(2) syscall produces vnode-backed M_EXTPG mbufs whose m_epg_pa[] array stores the physical addresses of the file's actual page-cache pages (sys/kern/kern_sendfile.c:963). On PMAP_HAS_DMAP architectures (amd64, arm64, riscv), the kernel direct map allows translating any physical address to a kernel virtual address via PHYS_TO_DMAP(). The kTLS RX decrypt path (sys/opencrypto/criov.c:273, sys/crypto/aesni/aesni.c:599-605) calls AES_GCM_decrypt with input and output pointing to the same DMAP-derived address, writing plaintext directly over the page-cache page. Three guards exist to prevent EXTPG mbufs from reaching the in-place decrypt: mb_unmapped_compress (gated on payload length <= ~224 bytes on amd64, bypassed by using records >224 bytes), mb_unmapped_to_ext (converts EXTPG for interfaces lacking IFCAP_MEXTPG such as lo0, but allocates sf_buf whose kva == PHYS_TO_DMAP(pa) on DMAP architectures, preserving the same physical mapping), and sb_mark_notready (moves data into the kTLS decrypt queue with no M_EXTPG check at all). All three are bypassable in sequence. The vulnerable sendfile/EXTPG path was introduced in commit 3c0e56850511 (~2020) and first shipped in FreeBSD 13.0. No CWE is assigned in the available data; the root cause class most closely corresponds to improper isolation between kernel subsystems - specifically, the assumption that EXTPG mbufs from sendfile are safe to decrypt in-place without verifying that the output buffer is not a live page-cache page.