CVE-2026-45256: FreeBSD thr_kill2 DoS Vulnerability

CVE-2026-45256 Overview

CVE-2026-45256 is a privilege management flaw ([CWE-269]) in the FreeBSD kernel's thr_kill2(2) system call. When delivering a signal to a specific thread, thr_kill2(2) invoked p_cansignal() to determine whether the operation was permitted but failed to check the result before delivering the signal. The signal was sent even when the permission check failed, and the error was only returned to the caller after delivery.

An unprivileged local user who knows or can guess a target's process and thread IDs can send any signal to processes owned by other users, root, or processes in other jails. Thread IDs are allocated globally and sequentially, so they can be brute-forced without visibility into the target.

Critical Impact
A local attacker can stop or terminate arbitrary processes, including critical system daemons and processes running in other jails, resulting in denial of service across the host.

Affected Products

FreeBSD 14.3 (including patch levels p1 through p14)
FreeBSD 14.4 (including rc1 and patch levels p1 through p5)
FreeBSD 15.0 (including patch levels p1 through p9) and 15.1-RC2

Discovery Timeline

2026-06-26 - CVE-2026-45256 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-45256

Vulnerability Analysis

The thr_kill2(2) system call in FreeBSD allows a caller to deliver a signal to a specific thread within a target process. Signal delivery to processes and threads outside the caller's own credentials must pass an authorization check performed by the kernel helper p_cansignal(). This function enforces standard UNIX signaling rules and, critically, enforces FreeBSD jail boundaries.

In the vulnerable code path, p_cansignal() is called and its return value is captured, but the signal is dispatched to the target thread regardless of whether authorization succeeded or failed. The system call then returns the captured error code to userspace, giving the misleading impression that the operation was rejected. In reality the target thread has already received the signal.

The impact is amplified because FreeBSD assigns thread IDs from a global, sequential namespace. An unprivileged attacker can enumerate live thread IDs by brute force with no prior visibility into what processes exist on the system or in adjacent jails.

Root Cause

The root cause is a missing conditional check on the return value of p_cansignal() inside the thr_kill2(2) handler. The permission decision was computed but not enforced, resulting in a broken access control primitive at the kernel signal delivery layer.

Attack Vector

Exploitation requires local access with unprivileged user credentials. An attacker iterates candidate thread IDs and calls thr_kill2(2) with a chosen signal such as SIGKILL, SIGSTOP, or SIGTERM. Because thread IDs are sequential and global, an attacker can systematically target long-running system daemons, other users' processes, or processes inside other jails. A jailed process can escape jail signaling restrictions and affect the host or peer jails. Consult the FreeBSD Security Advisory for technical specifics.

Detection Methods for CVE-2026-45256

Indicators of Compromise

Unexpected termination or stop of long-running daemons such as sshd, syslogd, named, or database processes without corresponding administrator actions in audit logs.
Processes inside jails exiting with signal-terminated status codes that do not match any in-jail activity.
Bursts of thr_kill2 system calls from non-privileged user sessions visible in kernel audit trails.

Detection Strategies

Enable FreeBSD auditd with the pc (process) audit class and review records for thr_kill2 invocations by unprivileged UIDs targeting processes outside their credential scope.
Correlate abnormal SIGKILL or SIGSTOP delivery events against the credentials of the sending process using DTrace probes on the proc:::signal-send provider.
Alert when critical service supervisors such as rc.d, service, or process managers detect repeated unexpected restarts of protected daemons.

Monitoring Recommendations

Baseline normal signal traffic between users and jails and alert on deviations, particularly cross-UID or cross-jail signal delivery.
Forward audit and DTrace telemetry to a centralized SIEM for retention and correlation with user session activity.
Monitor uptime and process supervision metrics for host daemons and jailed workloads to detect DoS conditions early.

How to Mitigate CVE-2026-45256

Immediate Actions Required

Apply the FreeBSD security patch for FreeBSD 14.3, 14.4, and 15.0 as published in FreeBSD-SA-26:25.thr.
Reboot affected systems after patching so the corrected kernel is loaded, since the fix resides in kernel signal handling code.
Audit multi-tenant hosts and jail hosts for unexpected process terminations occurring before the patch was applied.

Patch Information

FreeBSD has released a kernel update that adds the missing permission check to thr_kill2(2). The patched kernel enforces the result of p_cansignal() before dispatching the signal, restoring the intended access control and jail boundaries. Refer to FreeBSD-SA-26:25.thr for exact commit hashes, patched patch-level versions, and installation instructions using freebsd-update.

Workarounds

No supported workaround fully mitigates the flaw without patching, because the missing check is inside a kernel system call.
On multi-tenant systems, restrict local shell access to trusted users until the kernel is updated, since exploitation requires a local unprivileged account.
Use mac_seeotheruids or similar Mandatory Access Control policies to reduce cross-user visibility, which raises the cost of thread ID discovery but does not close the underlying flaw.

bash

# Configuration example
# Apply the FreeBSD binary update and reboot into the patched kernel
freebsd-update fetch
freebsd-update install
shutdown -r now