CVE-2026-45256: FreeBSD thr_kill2 Permission Bypass Leads to Denial of Service

Technical summary

CVE-2026-45256 is a permission enforcement bypass in the FreeBSD kernel's thr_kill2(2) system call. When delivering a signal to a specific thread, the function invokes p_cansignal() to validate whether the caller has permission to signal the target process. However, the implementation fails to act on the result of this check—the signal is delivered regardless of whether p_cansignal() returned success or failure. The system call then returns the error code to the user, creating a race-like condition where permission denial is reported after the signal has already been sent. This affects both standard privilege boundaries (preventing unprivileged users from signaling privileged processes) and jail isolation mechanisms (which use the same enforcement path). Thread ID allocation is sequential and global, enabling attackers to systematically enumerate thread IDs through brute force with no system introspection required.

Business impact

This vulnerability enables denial-of-service attacks against FreeBSD systems from any local user account. An attacker can target critical system services—DNS resolvers, SSH daemons, database servers, web services—and force them offline by sending termination signals. In multi-tenant or jail-based deployments, the cross-boundary nature of the flaw is particularly severe: a jailed application or customer account can disrupt host system services or competing workloads in other jails. Affected systems lose availability guarantees, and recovery requires manual intervention. For organizations running FreeBSD in production (particularly in hosting, cloud, or appliance scenarios), this represents a material uptime and customer-trust risk until patched.

Affected systems

All FreeBSD versions are affected across the range indicated in the vulnerability record. FreeBSD users and operators, particularly those running multi-user or containerized/jailed deployments, should prioritize assessment. This includes FreeBSD systems used as web servers, mail servers, routers, NAS appliances, or in cloud infrastructure. Systems with local user access or where unprivileged processes are deployed in jails are at highest risk.

Exploitability

The barrier to exploitation is low. An attacker needs only local system access (a valid user account or a process running in a jail) and knowledge of a target's process ID and thread ID. Since thread IDs are allocated sequentially and globally, they can be discovered through brute-force enumeration—a straightforward but potentially noisy attack. No special tools, race conditions, or advanced exploitation techniques are required. The CVSS score of 5.5 (Medium) reflects the local-access requirement, but the practical ease of discovery and signal delivery makes this readily exploitable in real environments. This is not a difficult bug to weaponize for an attacker with a foothold.

Remediation

FreeBSD has released patches that correct the permission check in thr_kill2(). The fix ensures that if p_cansignal() denies the operation, the signal is not delivered and an error is returned to the caller without side effects. System administrators must apply the relevant security update to all affected FreeBSD installations. Verify the exact patched versions against the official FreeBSD security advisory, as patch versions vary by release branch (stable, release, and legacy series may have different version numbers).

Patch guidance

Check the FreeBSD security advisories page for the specific patch release corresponding to your installed FreeBSD version. Updates are typically cumulative; install the latest patch release for your branch. For example, if running FreeBSD 13.x or 14.x, identify the next available patch release (e.g., 13.2-RELEASE-pX or 14.x-RELEASE-pY) and apply it via freebsd-update or by rebuilding from source. Test patches in a non-production environment first to verify compatibility with local customizations. After patching, confirm that system daemons and jailed services remain operational.

Detection guidance

Retrospective detection is challenging without extensive kernel auditing. Consider deploying process monitoring to detect unexpected termination of critical daemons (e.g., sshd, syslogd, named). Monitor system logs for SIGTERM or SIGKILL signals sent to privileged processes from unprivileged users—this should be rare and warrant investigation. On systems with auditd enabled, review audit logs for failed p_cansignal() checks paired with subsequent signal delivery. Prospective protection requires patching; detection is a supporting layer. In multi-tenant or jail scenarios, tighter resource isolation and monitoring of cross-jail signal attempts (if visible in your environment) may surface attacks.

Why prioritize this

Although the CVSS score is Medium (5.5), prioritize this vulnerability for near-term patching due to ease of exploitation, lack of authentication barriers, and direct denial-of-service impact. Any FreeBSD system with untrusted local users or jailed applications is at risk. The sequential thread ID allocation makes the attack reliable and discoverable without system introspection. In production environments, especially those serving multiple customers or running critical services, this deserves urgent attention.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector (AV:L), low attack complexity (AC:L), and requirement for low privileges (PR:L). The impact is confidentiality: None, integrity: None, availability: High (A:H), capturing the denial-of-service nature. The score does not account for the trivial nature of thread ID discovery via sequential enumeration or the practical ease of exploitation in real deployments, making it a reasonable but somewhat conservative assessment. In environments with many untrusted local accounts or jails, actual risk may be perceived as higher.

Frequently asked questions