CVE-2026-45257: FreeBSD KTLS Privilege Escalation Flaw

CVE-2026-45257 Overview

CVE-2026-45257 is a local privilege escalation vulnerability in the FreeBSD kernel TLS (KTLS) receive path. The KTLS receive code decrypts each record in place, assuming the mbufs holding received data are anonymous and safe to modify. This assumption fails for data placed on a socket by sendfile(2), which references file-backed memory through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When such data traverses a loopback connection without transmit-side KTLS, decryption overwrites the file's page cache directly. The flaw affects FreeBSD 14.3, 14.4, and 15.0 release branches.

Critical Impact
An unprivileged local user who can read a file can overwrite its contents by transmitting the file over a loopback socket with KTLS receive enabled, bypassing file flags such as schg and enabling privilege escalation through setuid binary overwrite.

Affected Products

FreeBSD 14.3 (base release through patch level p14)
FreeBSD 14.4 (rc1, base release through patch level p5)
FreeBSD 15.0 (base release through patch level p9) and 15.1-rc2

Discovery Timeline

2026-06-26 - CVE-2026-45257 published to NVD
2026-06-27 - Last updated in NVD database

Technical Details for CVE-2026-45257

Vulnerability Analysis

The FreeBSD kernel TLS subsystem offloads TLS record processing into the kernel to allow zero-copy transmission with sendfile(2). On the receive side, the kernel decrypts each TLS record in place within the mbuf chain to avoid an extra copy. This optimization assumes every receive mbuf points to anonymous, writable memory owned by the socket buffer.

When a sender uses sendfile(2) over a loopback connection without enabling KTLS on the transmit side, the socket buffer holds mbufs that directly reference file-backed page cache pages through M_EXTPG or EXT_SFBUF external storage. The receiver's KTLS decrypt routine treats these pages as scratch buffers and writes plaintext output back into them. The result is that decryption output is committed to the backing file's page cache and eventually written to disk. The weakness is classified under [CWE-123] Write-what-where Condition.

Root Cause

The root cause is a missing check in the KTLS receive path. The code does not verify that mbuf pages are anonymous before performing in-place decryption. File-backed mbufs produced by sendfile(2) reach the decryption routine unchanged and are treated as if they were private copies of the ciphertext.

Attack Vector

A local unprivileged user opens a readable file, sets up a loopback TCP connection, enables KTLS receive on the receiver socket, and calls sendfile(2) on the sender socket to transmit the target file. Because the transmit side does not enable KTLS, the file-backed mbufs pass to the receiver's decrypt path. The attacker controls the ciphertext and the negotiated key, so the decrypted plaintext written into the page cache is attacker-chosen. Overwriting a setuid binary yields root privileges. The write bypasses immutable flags such as schg because it operates below the VFS layer.

No verified public proof-of-concept code is available. See the FreeBSD Security Advisory for reproduction details.

Detection Methods for CVE-2026-45257

Indicators of Compromise

Unexpected modification timestamps on setuid or schg-flagged binaries where content hashes diverge from vendor-provided baselines.
Unprivileged processes calling setsockopt with TCP_TXTLS_ENABLE or TCP_RXTLS_ENABLE on loopback sockets combined with sendfile(2) invocations against sensitive files.
New root-owned processes spawned from binaries recently accessed by non-root users.

Detection Strategies

Audit execve events for setuid binaries whose on-disk hash no longer matches the package manager manifest reported by pkg check -s.
Monitor DTrace or audit(4) records for the sequence of socket, sendfile, and TLS-related setsockopt calls originating from unprivileged UIDs on loopback endpoints.
Alert on writes to files owned by root that occur without a corresponding open(O_WRONLY) syscall from a privileged process.

Monitoring Recommendations

Enable the FreeBSD audit framework with the fm and ex classes to capture file modification and execution events for later correlation.
Baseline setuid binary inventory and hashes, then run scheduled integrity checks against the baseline.
Forward host telemetry to a centralized analytics platform for cross-host correlation of anomalous loopback KTLS use.

How to Mitigate CVE-2026-45257

Immediate Actions Required

Apply the FreeBSD patches released in security advisory FreeBSD-SA-26:26.ktls to all affected 14.3, 14.4, and 15.0 systems.
Reboot affected hosts after patching so the updated kernel is loaded.
Verify integrity of setuid binaries against known-good hashes before returning systems to production.

Patch Information

FreeBSD has published fixed kernels in FreeBSD Security Advisory FreeBSD-SA-26:26.ktls. Administrators should install the updated kernel package with freebsd-update on release branches or rebuild from the corresponding stable/14 or stable/15 source tag. Additional discussion is available in the Openwall OSS Security post and the Heise news coverage.

Workarounds

Disable kernel TLS on hosts that do not require it by setting kern.ipc.tls.enable=0 in /etc/sysctl.conf until patches are applied.
Restrict access to loopback sockets and KTLS functionality for unprivileged users through mandatory access control policies such as mac_portacl.
Remove the setuid bit from non-essential binaries to reduce the privilege escalation surface exposed by an arbitrary file overwrite.

bash

# Disable KTLS as a temporary workaround until patches are applied
sysctl kern.ipc.tls.enable=0
echo 'kern.ipc.tls.enable=0' >> /etc/sysctl.conf

# Apply the vendor patch on a release branch
freebsd-update fetch
freebsd-update install
shutdown -r now