CVE-2026-45257: FreeBSD KTLS Local Privilege Escalation via File Overwrite

Technical summary

CVE-2026-45257 is a write-after-free vulnerability in FreeBSD's KTLS receive path. The kernel's implementation assumes all received data resides in anonymous, writable memory buffers (mbufs). However, data transmitted via sendfile(2) can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When such file-backed data traverses a loopback socket with KTLS receive enabled but KTLS transmit disabled, the mbufs remain unencrypted and unchanged. The receive-side decryption operation then modifies these mbufs in place, directly corrupting the page cache backing the original file. This bypasses standard file protection mechanisms (immutable flags) and persists to disk, enabling arbitrary file modification with user-level privileges.

Business impact

Organizations running FreeBSD as a server, workstation, or containerized environment face significant risk of data integrity compromise and privilege escalation attacks. A local user with filesystem read access can weaponize this flaw to overwrite system binaries, configuration files, or application code, leading to unauthorized command execution, lateral movement, and potential data theft. Systems with shared user accounts or multi-tenant deployments are particularly vulnerable. The ability to bypass immutable file flags and directly corrupt disk-backed data means standard protective measures provide limited defense.

Affected systems

FreeBSD systems running versions with KTLS support. The vendor data indicates multiple FreeBSD releases are affected. Verify the specific versions and patch status against FreeBSD's official security advisories, as the ground-truth data does not enumerate precise version ranges. Systems must have KTLS receive configured on loopback interfaces for exploitation to succeed, which may limit exposure in air-gapped or non-network-facing deployments.

Exploitability

Exploitability is high for affected systems. The attack requires only local user access and does not demand special kernel privileges. No user interaction or complex race conditions are necessary—the vulnerability triggers reliably when sending file-backed data over loopback with KTLS receive active. The attack surface is limited by whether KTLS is deployed on loopback interfaces in production, but the simplicity of the exploitation mechanism and low barrier to entry make this a high-priority local privilege escalation vector.

Remediation

Apply security patches from FreeBSD as soon as they become available. The fix likely modifies the KTLS receive path to copy file-backed mbufs to anonymous memory before decryption, rather than decrypting in place. Disable or restrict KTLS receive on loopback interfaces if KTLS transmit is not symmetrically enabled, pending patch deployment. Limit local user access where feasible. Organizations should verify patch availability and deployment timelines against FreeBSD's official security advisory.

Patch guidance

Consult FreeBSD's official security advisories for patch availability and version information. Apply patches to all affected FreeBSD systems as part of a coordinated change management process. Test patches in non-production environments first to confirm compatibility with local configurations and dependent services. After patching, verify that KTLS functionality continues to operate correctly and that loopback communication is not disrupted. Monitor for any post-patch anomalies in file integrity or system behavior.

Detection guidance

Monitor for suspicious file modifications, particularly to setuid binaries, system libraries, and kernel modules. Audit filesystem access logs for writes to protected files by unprivileged users. Enable file integrity monitoring (FIM) tools to detect unauthorized changes to critical system files. Look for unusual sendfile(2) or loopback socket activity in syscall audit logs. Check for mismatched KTLS receive and transmit configurations on loopback interfaces. Monitor page cache behavior for signs of direct memory writes bypassing normal file operations.

Why prioritize this

This vulnerability merits high priority due to its direct path to local privilege escalation, ease of exploitation, and potential for persistent system compromise. The ability to overwrite setuid binaries and bypass immutable file flags makes this a critical threat to system integrity. While exploitation requires local access, the low complexity and lack of special privilege requirements elevate risk. Organizations should treat this as a priority patch, especially on multi-user or shared systems.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects high impact across confidentiality, integrity, and availability, combined with a low attack complexity and local attack vector. The vulnerability requires user-level privileges but enables full system compromise through file overwrites. The score appropriately captures the severity of unrestricted file modification and privilege escalation, though it does not account for the practical requirement that KTLS receive must be explicitly enabled on loopback interfaces.

Frequently asked questions