CVE-2026-45251: Kernel Use-After-Free Vulnerability

CVE-2026-45251 Overview

CVE-2026-45251 is a use-after-free vulnerability in the FreeBSD kernel affecting the handling of blocked threads waiting on file descriptors through poll(2) or select(2) system calls. When a file descriptor is closed while a thread is blocked waiting on it, certain descriptor types fail to unlink the blocked thread from the per-object wait queue before freeing the underlying object. The flaw is tracked under CWE-416 and documented in the FreeBSD Security Advisory.

Critical Impact

An unprivileged local user can trigger the use-after-free condition and exploit it to obtain superuser privileges on affected FreeBSD systems.

Affected Products

• FreeBSD operating system (see vendor advisory for affected branches)
• Systems running file descriptor types with deficient wait queue cleanup
• Multi-user FreeBSD deployments with untrusted local accounts

Discovery Timeline

• 2026-05-21 - CVE-2026-45251 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-45251

Vulnerability Analysis

The vulnerability resides in the FreeBSD kernel logic that manages blocked threads waiting on file descriptors. When a thread invokes poll(2) or select(2), it is enqueued on a per-object wait queue associated with the underlying file descriptor. The blocked thread does not hold a reference to the underlying object during the wait.

If another thread closes the file descriptor while the first thread remains blocked, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. For certain file descriptor types, this unlink step is missing. The object is freed while the blocked thread is still linked to its wait queue.

When the blocked thread is later woken, it dereferences memory that has already been released, producing a classic use-after-free condition. An attacker with local access can race the close and wake operations to manipulate freed kernel memory and escalate privileges.

Root Cause

The root cause is incomplete wait queue cleanup during file descriptor teardown for affected descriptor types. The kernel frees the descriptor object without first unlinking all blocked threads, violating the lifetime contract between the wait queue and the object it references.

Attack Vector

Exploitation requires local code execution as an unprivileged user. The attacker creates a vulnerable file descriptor type, places one thread into a blocking poll(2) or select(2) call, and closes the descriptor from a second thread. Reallocating the freed kernel memory with attacker-controlled data before the blocked thread wakes enables privilege escalation to root.

No verified public proof-of-concept code is available at the time of writing. Refer to the FreeBSD Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-45251

Indicators of Compromise

• Unexpected kernel panics or page faults referencing wait queue structures or file descriptor objects
• Local user processes performing rapid poll(2) or select(2) calls combined with concurrent close(2) operations on the same descriptor
• Privilege transitions from unprivileged users to UID 0 without corresponding setuid binary execution or sudo activity

Detection Strategies

• Audit kernel crash dumps for use-after-free signatures involving wait queue traversal during thread wakeup
• Monitor process syscall patterns for tight races between close(2) and poll(2)/select(2) on shared descriptors
• Correlate sudden root-level process creation with preceding kernel warnings on FreeBSD hosts

Monitoring Recommendations

• Enable FreeBSD audit(8) to record syscall activity and privilege changes for forensic review
• Forward kernel logs to a centralized SIEM and alert on panics referencing selfd, knote, or wait queue routines
• Track local user processes that spawn root shells or modify /etc/master.passwd shortly after intensive descriptor activity

How to Mitigate CVE-2026-45251

Immediate Actions Required

• Apply the patches referenced in the FreeBSD Security Advisory FreeBSD-SA-26:19.file to all affected hosts
• Inventory FreeBSD systems that grant shell access to untrusted users and prioritize them for patching
• Restrict local account creation on production FreeBSD servers until patches are deployed

Patch Information

FreeBSD has released a security advisory addressing the use-after-free condition. Administrators should consult FreeBSD-SA-26:19.file for the specific kernel revisions, errata branches, and freebsd-update instructions applicable to their release. Reboot the system after patch installation to load the corrected kernel.

Workarounds

• No reliable workaround exists short of patching; the affected code paths are core kernel functionality
• Reduce exposure by removing interactive shell access for non-administrative users on critical FreeBSD hosts
• Apply mandatory access controls such as mac_partition(4) or jails to limit the syscall surface available to local users

# Apply FreeBSD security updates and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now