What is the CVSS score of CVE-2026-5398?

CVE-2026-5398 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FreeBSD are affected by CVE-2026-5398?

CVE-2026-5398 is a local privilege escalation vulnerability in FreeBSD 13.5 through 15.0 that allows unprivileged users to gain root-level access through a use-after-free flaw in terminal handling.

How to fix or mitigate CVE-2026-5398?

Within 24 hours: Inventory all FreeBSD systems running versions 13.5 through 15.0 and document their network criticality and local user access policies. Within 7 days: Implement or reinforce local authentication controls to restrict unprivileged user access to affected systems; review sudo/doas configurations to minimize unnecessary privilege grants. Within 30 days: Monitor vendor security advisories for patch availability; evaluate feasibility of upgrading to unaffected FreeBSD versions or implementing application-level sandboxing for high-risk services; test and deploy patches immediately upon vendor release.

FreeBSD CVE-2026-5398

EUVD-2026-24589 HIGH

Use After Free (CWE-416)

2026-04-22 freebsd

Use After Free Information Disclosure Memory Corruption Freebsd

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 22, 2026 - 15:23 vuln.today

CVSS changed

Apr 22, 2026 - 15:22 NVD

8.4 (HIGH)

EUVD ID Assigned

Apr 22, 2026 - 03:00 euvd

EUVD-2026-24589

Analysis Generated

Apr 22, 2026 - 03:00 vuln.today

CVE Published

Apr 22, 2026 - 02:23 nvd

HIGH 8.4

DescriptionCVE.org

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to freed memory.

A malicious process can abuse the dangling pointer to grant itself root privileges.

AnalysisAI

Local privilege escalation in FreeBSD 13.5 through 15.0 allows unprivileged processes to gain root privileges by exploiting a use-after-free condition in the TIOCNOTTY ioctl implementation. When a process detaches from its controlling terminal and exits, a dangling pointer in the terminal structure references freed session memory, which attackers can manipulate to escalate privileges. This vulnerability affects multiple stable and release branches with CVSS 8.4 (High) but low EPSS probability (0.02%, 5th percentile), indicating theoretical severity without observed widespread exploitation. Not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis.

Technical ContextAI

This vulnerability stems from improper cleanup in the FreeBSD kernel's tty subsystem, specifically the TIOCNOTTY ioctl handler used to detach a process from its controlling terminal. The implementation (CWE-416: Use After Free) fails to nullify the back-pointer from the tty structure to the process session structure after detachment. When the process subsequently exits and its session is freed, the terminal device retains a stale pointer to deallocated kernel memory. This classic dangling pointer condition creates a window where subsequent operations on the terminal device may dereference freed memory. Because terminal structures are privileged kernel objects with elevated context, controlling the contents of the freed memory region through heap manipulation techniques allows arbitrary kernel memory writes, ultimately enabling privilege escalation to root (uid 0). The vulnerability exists across multiple FreeBSD stable branches (13.x, 14.x, 15.x) as identified by CPE cpe:2.3:a:freebsd:freebsd, indicating a long-standing implementation flaw in core kernel infrastructure.

RemediationAI

Apply vendor-released patches immediately via freebsd-update utility or rebuild kernel from patched sources. Specific fixed versions are FreeBSD 13.5-RELEASE-p12, 14.3-RELEASE-p11, 15.0-RELEASE-p6, and 14.4-RELEASE-p2 as detailed in FreeBSD-SA-26:10.tty security advisory at https://security.freebsd.org/advisories/FreeBSD-SA-26:10.tty.asc. For systems where immediate patching is not feasible, restrict local user access to trusted accounts only and implement kernel security modules like MAC framework policies to limit privilege escalation paths, though these are incomplete mitigations that reduce but do not eliminate risk. Monitor for unusual process behavior around terminal device access (dmesg, dtrace probes on tty ioctls). No effective workaround exists that fully prevents exploitation while maintaining normal terminal functionality, making patching the only complete remediation. System reboot is required after kernel update to activate the fix.