FreeBSD EUVD-2026-66253

Exploitation requires a local unprivileged user account on a vulnerable FreeBSD system, confirmed by CVSS PR:L and the vendor description explicitly stating 'an unprivileged local user can exploit this race.' The attacker must be able to create POSIX shared memory objects (shm_open(2)) - a capability available to all unprivileged users by default on FreeBSD - and must invoke the FIOSSHMLPGCNF ioctl concurrently from two threads or processes against the same object before any backing memory has been allocated. The race window is narrowly scoped to the initialization phase of largepage shared memory objects; once a page size is set and memory is allocated, the condition no longer applies. Limiting factors: the attack vector is strictly local (AV:L), so remote attackers without prior shell access cannot exploit this directly; the vulnerability is in the largepage shared memory code path, which is not invoked by applications that use only standard (non-hugepage) shared memory; and systems restricting local user access (single-user appliances, read-only jails, mandatory access control enforcement) significantly reduce or eliminate exposure.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat model: any unprivileged local user with shell access can attempt exploitation with no required user interaction and no elevated starting privileges. Attack complexity is rated low, which - while somewhat optimistic for a race condition - reflects that TOCTOU races in ioctl handlers are well-understood and reliably triggerable via concurrent thread spawning without sophisticated primitives. The EPSS score of 0.13% (3rd percentile) is strikingly low relative to the CVSS severity, a divergence that is consistent with absence of public exploit code and no CISA KEV listing; this suggests risk is real but not yet actively operationalized by threat actors. Local privilege escalation flaws in BSD kernels have historically attracted targeted exploitation in shared-hosting, jail-based multi-tenancy, and post-intrusion lateral movement scenarios, even absent mass weaponization. The missing rangelock is a narrow but well-defined defect - developers familiar with kernel locking primitives could construct a working proof-of-concept from the advisory description alone. Organizations running FreeBSD in multi-user environments, co-located servers, or as a hypervisor base should treat this as a high-priority patch given the low barrier to exploitation once local access is established.

An unprivileged attacker with a local shell account on a vulnerable FreeBSD host writes a program that creates a largepage POSIX shared memory object, then races two threads to simultaneously invoke the FIOSSHMLPGCNF ioctl before either thread's write completes. Both threads observe an unconfigured object, both proceed to set conflicting page sizes, and the resulting inconsistent kernel state is leveraged through a subsequent memory operation to overwrite a kernel data structure and escalate to root. No public exploit code has been identified at time of analysis, but the advisory description provides sufficient implementation detail for a kernel-familiar researcher to construct a reliable proof-of-concept.