FreeBSD EUVD-2026-66236

Exploitation requires a local, authenticated session with a low-privilege user account (CVSS PR:L) on a FreeBSD system running one of the affected release versions. The target system must have multiple audio devices present - this is the hardware prerequisite that creates the multi-channel sync group locking scenario the vulnerable ioctl operates on; single-audio-device systems do not expose the vulnerable code path in the same way. The user must have permission to open and issue ioctls against the audio devices, which by default on FreeBSD requires membership in the 'audio' group. The attack exploits a kernel-level race condition, requiring the attacker to win a timing contest between the ioctl's sleep window and a concurrent sync group free operation. Factors limiting exploitation: no remote attack vector (AV:L - physical or pre-existing shell access required); no scope change (S:U - kernel compromise is contained to the local system); audio device access permissions must not have been further restricted by devfs rules; and the vulnerability does not affect systems without multiple audio devices or those where the sound module is not loaded.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a credible local privilege escalation with no user interaction needed and full CIA impact - characteristics of a complete kernel takeover. The vendor's AC:L rating asserts reliable triggerability, though race conditions in practice can require repeated attempts; my independent assessment rates this AC:H due to the timing dependency and multi-device prerequisite (see assessed vector). EPSS at 0.16% (6th percentile) is notably low for a privilege escalation: no public POC is known, no CISA KEV listing exists, and FreeBSD's narrower deployment footprint relative to Linux limits the exposed population. The realistic threat is highest on FreeBSD multi-user workstations or interactive servers with audio hardware - scenarios common in some BSD-centric infrastructure but rare in typical enterprise data centers. On server deployments without audio devices, this vulnerability is not triggerable. The gap between CVSS 7.8 and a 6th-percentile EPSS is consistent with a credible-but-unexercised local escalation path rather than an actively targeted flaw.

A low-privileged local user on a FreeBSD workstation with two or more audio devices opens the sound device and issues a crafted ioctl targeting the sync group mechanism, then races a concurrent thread to free the sync group structure during the sleep window between lock release and reacquisition. By winning this race - potentially requiring repeated attempts - the attacker dereferences freed kernel heap memory, and through controlled heap grooming redirects execution or overwrites process credential structures to gain root. No public proof-of-concept is known at time of analysis, but the CVSS AC:L vendor rating suggests the race is considered reliably exploitable.