FreeBSD EUVD-2026-66234

Exploitation requires a local unprivileged user account on the affected FreeBSD system with the ability to invoke hwpmc(4) PMC attachment interfaces (via pmcstat(8) or direct system calls). The attacker must attach PMCs to a target process before that process calls execve(2) to execute a setuid or setgid binary - this requires either timing the attachment opportunistically or, more reliably, controlling the target process's lifecycle (e.g., monitoring a child process or a process the attacker spawned). Exploitation is strictly local (AV:L); remote unauthenticated exploitation is not possible. Systems where unprivileged users are prohibited from using the hwpmc facility - via sysctl restrictions or MAC policies - are not exploitable. Only FreeBSD 14.4-RELEASE before p9, 15.0-RELEASE before p13, and 15.1-RELEASE before p3 are listed as affected.

The vendor CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.8, but the I:H and A:H ratings warrant scrutiny: the described impact is continued PMC monitoring of a setuid process, which maps cleanly to C:H (side-channel leakage of sensitive data from a privileged context) but does not describe a mechanism for direct integrity modification or availability disruption. The I:H and A:H appear to represent the vendor's assessment of potential secondary exploitation chains - for example, using PMC-derived timing data to mount a side-channel attack that subsequently breaks cryptographic protections - rather than confirmed direct impacts. EPSS at 0.15% (5th percentile) is consistent with the local-only attack vector and the specialized nature of PMC tooling: exploiting this requires a local shell account plus the ability to use hwpmc, which is not a common attacker posture on production FreeBSD systems. No CISA KEV listing and no identified public exploit code further reduce urgency. Real-world risk is most relevant to multi-user FreeBSD deployments (servers, BSD-based appliances) where untrusted local users exist - a non-default but plausible scenario. This is a patch-cycle priority rather than an emergency response item for most organizations.

A local unprivileged user on a multi-user FreeBSD system uses pmcstat(8) or a custom hwpmc client to attach performance monitoring counters to a target process - for example, a shell script that will subsequently invoke sudo or passwd. When the target process calls execve() to execute the setuid binary, the kernel's inverted check fails to detach the user's PMCs, and the attacker continues receiving a stream of hardware counter events (cache misses, instruction counts, memory access patterns) from the now-elevated process, enabling side-channel inference of cryptographic operations or sensitive data. No public exploit code has been identified at time of analysis.