EUVD-2026-39964Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged shell
-
DeliveryOpen IPv6 socket, call IPV6_MSFILTER
-
ExploitRace concurrent thread to free filter struct
-
ExecutionTrigger use-after-free on stale pointer
-
ImpactCorrupt kernel memory, escalate to root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local unprivileged account on the FreeBSD host able to make IPv6 socket calls and invoke the IPV6_MSFILTER setsockopt option; the attacker must win the race in which the kernel handler drops and reacquires its serializing lock around the userspace copyin of the source-filter list, and concurrently free the multicast filter structure in that window. Limiting factors: the attack is local only (AV:L, not network-reachable), requires an existing low-privilege account (PR:L), needs no user interaction (UI:N), and depends on reliably winning a kernel race condition - which constrains it to attackers with on-host access and meaningful race-tuning effort rather than opportunistic remote attackers. |
| Impact | Signals are coherent and point to a serious-but-not-urgent issue. The CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects total system compromise but only via local access by an already-authenticated low-privileged user (PR:L) - not remotely reachable. SSVC reinforces this: Technical Impact 'total' but Exploitation 'none' and Automatable 'no', the latter being expected for a kernel race condition that must be won at runtime. EPSS is very low (0.13%, 3rd percentile) and the CVE is not in CISA KEV, with no POC referenced. One point worth flagging for verification: the upstream CVSS lists AC:L, but exploitation hinges on winning a lock race (the dropped/reacquired serializing lock), which in practice involves race-tuning/heap-grooming effort - arguably AC:H. Net priority: a real local-priv-esc to patch on multi-user, shell, or container-host FreeBSD systems, but low likelihood of opportunistic mass exploitation given local-only access and no automation. |
| Exploit ScenarioDerived | A user with an unprivileged local shell account (or code running inside a jail/container) opens an IPv6 socket and repeatedly issues IPV6_MSFILTER setsockopt calls while a second thread concurrently frees the multicast filter structure during the handler's unlocked copyin window. By winning this race and grooming the freed kernel memory, the attacker forces the kernel to operate on a controlled stale pointer, corrupting kernel state to escalate to root. No public POC is referenced in the available intelligence, and the local-only, race-dependent nature (AV:L, runtime race) makes reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Local privilege escalation in the FreeBSD kernel arises from a use-after-free in the IPv6 multicast source-filter handler (IPV6_MSFILTER), affecting FreeBSD 14.3, 14.4, and 15.0 releases before their respective patch levels. An unprivileged local user can win a race against the handler's dropped-then-reacquired serializing lock to free the multicast filter structure out from under the kernel, corrupting memory to gain root-level control. There is no public exploit identified at time of analysis, and EPSS is very low (0.13%), consistent with CISA SSVC marking exploitation as 'none' and not automatable.
RemediationAI
Apply the vendor-released patch by updating to the fixed patch level for your branch: FreeBSD 14.3-RELEASE-p15, 14.4-RELEASE-p6, or 15.0-RELEASE-p10 or later, using freebsd-update (binary update) or by recompiling the kernel from the patched source per FreeBSD-SA-26:29 (https://security.freebsd.org/advisories/FreeBSD-SA-26:29.ip6_multicast.asc); a reboot is required for the new kernel to take effect. If immediate patching is not possible, reduce exposure by limiting local/shell access to trusted users only, since exploitation requires a local account - this is the most effective compensating control given the local attack vector, with the trade-off of restricting multi-user or container/jail workloads. There is no documented runtime toggle to disable IPV6_MSFILTER independently, so untrusted-user isolation and prompt patching are the practical mitigations; see also https://vuldb.com/vuln/374473.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in the FreeBSD kernel's socket-option handling for IPv6 multicast (the IPV6_MSFILTER setsockopt path), which manages per-socket source-address filter lists used for multicast group membership (RFC 3678-style source filtering). To copy the variable-length source-filter list from userspace, the handler releases its serializing lock during the copyin and then reacquires it - a classic time-of-check/time-of-use window. This maps to CWE-416 (Use After Free): a concurrent thread can free the multicast filter structure during the unlocked window, so the handler resumes operating on a dangling pointer to reclaimed kernel memory. The affected component is the freebsd:freebsd product per CPE cpe:2.3:a:freebsd:freebsd, specifically the ip6_multicast subsystem named in advisory FreeBSD-SA-26:29.
Know when Freebsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-priv account (AV:L/PR:L); AC:H because exploitation requires winning a kernel lock race; full kernel compromise yields C/I/A:H.
Primary rating from Vendor (freebsd).
CVSS VectorVendor: freebsd
Lifecycle Timeline
2DescriptionCVE.org
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory.
An unprivileged local user can exploit this use-after-free to escalate privileges.
Executive ViewAI
FreeBSD kernel versions 14.3, 14.4, and 15.0 contain a local privilege escalation vulnerability with no public exploit identified at time of analysis. This flaw allows unprivileged users with local system access to gain root-level control, exposing organizations to insider threats and compromised account risks. No vendor patch is currently available, requiring immediate interim access controls and monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local system access to trusted personnel only with justification and regular review; (2) Implement principle of least privilege for user accounts; (3) Disable IPv6 multicast kernel module if operationally feasible; (4) Deploy kernel integrity monitoring and process auditing to detect exploitation attempts; (5) Maintain continuous monitoring of CISA and FreeBSD official security advisories for patch availability; (6) Consider network isolation of critical FreeBSD systems pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement mess
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEAS
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, w
In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 1
GitHub PoC
Exploit-DB