The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data.
An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.
References
| Link | Resource |
|---|---|
| https://security.freebsd.org/advisories/FreeBSD-SA-26:26.ktls.asc | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/10/20 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/06/10/21 | Mailing List Third Party Advisory |
| https://www.heise.de/en/news/FreeBSD-Privilege-Escalation-Vulnerability-with-Tongue-in-Cheek-Codename-11329109.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Jun 2026, 18:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.freebsd.org/advisories/FreeBSD-SA-26:26.ktls.asc - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/10/20 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/10/21 - Mailing List, Third Party Advisory | |
| References | () https://www.heise.de/en/news/FreeBSD-Privilege-Escalation-Vulnerability-with-Tongue-in-Cheek-Codename-11329109.html - Third Party Advisory | |
| First Time |
Freebsd
Freebsd freebsd |
|
| CPE | cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.1:rc2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p12:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p14:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p13:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p8:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p4:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p3:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:p7:*:*:*:*:*:* cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:* |
26 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
26 Jun 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-26 15:16
Updated : 2026-06-27 05:16
NVD link : CVE-2026-45257
Mitre link : CVE-2026-45257
CVE.ORG link : CVE-2026-45257
JSON object : View
Products Affected
freebsd
- freebsd
CWE
CWE-123
Write-what-where Condition