FreeBSD Kernel CVE-2026-45257

Exploitation requires a standard unprivileged local user account with shell access - no special group membership, capability, sudo permission, or network-facing service interaction is needed. The target system must be running FreeBSD 13.0 through 15.0 on a PMAP_HAS_DMAP architecture (amd64, arm64, or riscv). Two kernel configuration defaults must be active: kern.ipc.mb_use_ext_pgs=1 (the boot-time default on all PMAP_HAS_DMAP architectures - no administrator action enables this, it is on by default) and MK_KERN_TLS built into the kernel (the default in GENERIC kernels). The attacker must be able to read the target file - world-readable SUID binaries such as /usr/bin/su satisfy this with no additional access. The attack runs entirely over the loopback interface (lo0) and requires no external network connectivity. Factors that DO NOT limit exploitation: chflags schg (system immutable flag) is explicitly confirmed to not prevent the overwrite. Factors that limit exploitation: FreeBSD 12.x and earlier are not affected; non-DMAP architectures (32-bit x86, mips, powerpc without DMAP) are not affected; systems with kern.ipc.mb_use_ext_pgs=0 or kernels built without MK_KERN_TLS are not affected.

No CVSS score, vector, or EPSS probability is provided in the available data - all CVSS metrics in this report are independently assessed. KEV status is unconfirmed; this vulnerability is not present in the CISA KEV catalog based on available data, though the June 9, 2026 public disclosure date means KEV lag remains plausible. Despite the absence of these enrichment signals, the real-world risk is assessed as critical based on first-principles analysis: a public exploit with confirmed root LPE in 1.5 seconds, zero race condition, no special group or capability required, and default preconditions on every PMAP_HAS_DMAP FreeBSD 13.0+ system. The exploit primitive is broadly applicable - any world-readable file can be overwritten, and the bypass of chflags schg extends impact to files that administrators consider protected. Multi-tenant deployments (hosting providers, jail-based infrastructure, containerized BSD environments) are acutely at risk because the attack vector is purely local and requires only a standard shell account. The functional equivalence to Linux Dirty Pipe (CVE-2022-0847, CVSS 7.8, EPSS ~0.45 at peak) provides a useful benchmark: Dirty Pipe saw rapid exploitation in cloud and hosting contexts within days of disclosure. The absence of CVSS/EPSS data should not be interpreted as low risk; it reflects NVD enrichment lag for a same-day disclosure.

An attacker with a standard unprivileged shell account creates a loopback TCP socket pair and issues a TCP_RXTLS_ENABLE setsockopt on the receiving socket, supplying a self-chosen AES-128-GCM key, salt, and IV - no privilege check is performed on this call. The attacker then uses sendfile(2) to send a target SUID-root binary (e.g., /usr/bin/su) into the sending socket; because lo0 lacks IFCAP_MEXTPG, Guard 2 remaps the EXTPG mbuf via sf_buf to the same underlying physical page rather than copying it. The kTLS RX path decrypts the record in-place over the page-cache physical page via DMAP, writing 36 bytes of setuid(0)+execve('/bin/sh') shellcode into the binary's entry point; the attacker executes the modified binary to obtain a root shell, achieving end-to-end LPE in approximately 1.5 seconds. A public PoC (bumsrakete.c) implementing this exact flow is included in the oss-security disclosure.