FreeBSD EUVD-2026-101855

Requires local, unprivileged access to a FreeBSD host (14.4/14.5/15.0/15.1 release lines before the listed patch levels) with SysV semaphore IPC available, which is standard/default - no special sysctl or configuration toggle is named in the advisory. The real limiting factor is the mechanism: the attacker must have a thread blocked in semop(2) AND create/destroy roughly 2^15 (32,768) semaphore sets landing in the same table slot to wrap the sequence counter before the blocked call re-validates. This race/timing dependency and the need for local code execution (AV:L, no remote path) materially limit practical exploitation; there is no user-interaction or authentication-beyond-local-login requirement.

Signals are largely consistent in pointing to a serious-but-not-urgent local privilege escalation. The FreeBSD-assigned CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 8.4) confirms this is local-only (AV:L) and requires no prior privileges beyond an unprivileged shell (PR:N), with total impact - matching the SSVC 'Technical Impact: total' rating. However, the vendor's AC:L is questionable: the description requires wrapping a 15-bit sequence counter, i.e. creating and destroying on the order of 32,768 semaphore sets in the same table slot while another thread is blocked in semop(2). That is a timing/race-dependent primitive, so I assess attack complexity as HIGH rather than LOW - flagging a conflict between the vendor CVSS and the described mechanics. Exploitation signals are low/benign: EPSS 0.18% (7th percentile), SSVC 'Exploitation: none' and 'Automatable: no', and the vulnerability is NOT in CISA KEV. No public exploit was identified in the provided data. Net: a genuine kernel heap out-of-bounds LPE worth patching on multi-user or shared FreeBSD hosts, but it is not a widespread-exploitation, drop-everything issue - it needs local access and a non-trivial race win, which is why automated/mass exploitation is rated unlikely.

An unprivileged local user on a shared FreeBSD host (e.g. a jail operator, CI runner user, or low-privileged account) blocks a thread in semop(2) on a target semaphore set, then rapidly creates and destroys semaphore sets to wrap the 15-bit IPC sequence number so the blocked call mistakes a new set for the original. The subsequent out-of-bounds access corrupts kernel heap memory, which the attacker shapes to escalate to root. No public proof-of-concept is identified at time of analysis, and success depends on winning the counter-wrap race.