FreeBSD EUVD-2026-39776

Requires a local unprivileged account on the affected FreeBSD system (AV:L, PR:L) - remote exploitation is not possible without a pre-existing local foothold. No special system configuration or non-default features are required; the thr_kill2(2) system call is available to all local users by default. The attacker must supply a valid process ID and thread ID, but both are globally sequential and discoverable by brute force with zero prior visibility into the target, making this a low-skill enumeration. Jail boundary bypass is applicable whenever the attacker is executing inside a FreeBSD jail with no special jail configuration needed, since p_cansignal() normally enforces this boundary and the bypass is unconditional. Limiting factors: the vulnerability only poses risk on systems where untrusted local users or jailed processes are present; single-tenant systems with no local shell access to untrusted parties are not at practical risk. Sustained DoS requires repeated signaling because killed daemons may be automatically restarted by rc.d or init.

The official CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the local, low-privilege exploitation vector and availability-only impact, but assigns Unchanged scope despite the advisory explicitly describing jail boundary bypass - this is a meaningful understatement of risk for jail-based multi-tenant FreeBSD deployments where cross-jail and host signaling represent a scope violation. SSVC assesses exploitation as 'none,' technical impact as 'partial,' and automatable as 'no,' consistent with the absence of a CISA KEV listing and no reported active exploitation at time of analysis. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified beyond SSVC inference. The brute-forceable, globally sequential thread ID space materially lowers real-world attack complexity: an attacker requires no prior knowledge of the target process structure. Availability impact is High - SIGKILL can terminate any process including init or critical daemons, with cascading system instability. Organizations operating FreeBSD in multi-user or jail-isolated environments should treat priority as higher than the base score implies due to the jail escape dimension.

A low-privileged local user or a process running inside a FreeBSD jail iterates through globally sequential thread IDs - requiring no prior knowledge of the target - and repeatedly calls thr_kill2() with candidate PID/TID pairs targeting a root-owned system daemon such as syslogd, cron, or ntpd. The kernel delivers SIGKILL to each matched thread regardless of the p_cansignal() result, terminating the daemon. A jailed attacker extends this attack to host processes by exploiting the same jail boundary bypass, effectively escaping the jail's isolation and causing cascading service failures across the host.