EUVD-2026-31257
GHSA-96wx-9xhw-cf8x
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges.
The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system.
AnalysisAI
Local privilege escalation in FreeBSD via the ptrace(PT_SC_REMOTE) interface allows an unprivileged user with debug access to a process to trigger arbitrary kernel code execution by abusing improperly validated parameters in syscall(2) and __syscall(2) meta-system calls. Affected releases include FreeBSD 14.3, 14.4, and 15.0 prior to their respective patch levels, and no public exploit identified at time of analysis. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit and inventory all FreeBSD systems running versions 14.3, 14.4, or 15.0; identify all users and service accounts with ptrace() debug permissions. Within 7 days: Restrict debug process access and ptrace() syscalls to essential administrative accounts only; disable PT_SC_REMOTE interface if not operationally required. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today