VulnSocial

CVE-2026-45251Exploit(freebsd / freebsd)

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch freebsd freebsd systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability. The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges.

freebsd CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-416

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • freebsd

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-05-29); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
freebsd
Products
freebsd

3 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-29: 1Mentions · 2026-05-31: 1PoC Mentioned / Linked · 2026-05-29: 1Exploit Tool / Code · 2026-05-29: 1Patch / Workaround · 2026-05-31: 1Technical Details · 2026-05-31: 105-2905-31
Signal classification2 categories
Exploit
150.0%
Patch
150.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-05-291
Exploit1
2026-05-311
Patch1
Full discourse2 posts
  • Mr. OS@ksg93rd
    Exploit

    #exploit #Kernel_Security An AI audit of FreeBSD https://blog.calif.io/p/an-ai-audit-of-freebsd ]-> setcred (CVE-2026-45250) https://github.com/califio/publications/tree/main/MADBugs/freebsd/setcred-CVE-2026-45250 ]-> ptrace (CVE-2026-45253) https://github.com/califio/publications/tree/main/MADBugs/freebsd/ptrace-CVE-2026-45253 ]-> procdesc (CVE-2026-45251) https://github.com/califio/publications/tree/main/MADBugs/freebsd/file-CVE-2026-45251 ]-> Bonus https://github.com/califio/publications/tree/main/MADBugs/freebsd // Disclaimer

    Post summary

    The post highlights a FreeBSD security audit that includes links to GitHub repositories containing exploit code for CVE-2026-45250, CVE-2026-45253, and CVE-2026-45251, but does not report active exploitation or provide patch information.

    00003231
    3.3K followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-45251 (CVSS 7.8) Use-after-free vulnerability in file descriptor handling allows unprivileged local users to escalate to superuser privileges. Affects poll(2)/select(2) system calls. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/wcRBzukP7T

    Post summary

    High‑severity CVE‑2026‑45251 is a use‑after‑free flaw that lets local users gain superuser privileges via poll/select calls; a patch is immediately required.

    0000040
    33 followersView on X
CPE platform detail29 entries

29 of 29 entries

PartVendorProductVersionTarget SWTarget HW
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.3--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd14.4--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--
OSfreebsdfreebsd15.0--

Explore more

Back to dashboardfreebsd CVEsfreebsd vulnerabilities