CVE-2026-45259: FreeBSD Authentication Bypass Vulnerability

CVE-2026-45259 Overview

CVE-2026-45259 is a Capsicum sandbox bypass in FreeBSD affecting the sigqueue(2) system call. When Capsicum was introduced in 2011, sigqueue(2) was marked as permitted in capability mode. However, the kern_sigqueue implementation omitted the capability mode check that restricts signal delivery to the calling process's own PID.

A sandboxed process in capability mode can send signals to any process it could signal under standard Unix permissions. This breaks the isolation guarantee that Capsicum is designed to provide. A compromised sandboxed process could send SIGKILL or SIGSTOP to other processes owned by the same user, or to any process if the sandbox runs as superuser.

Critical Impact
A compromised Capsicum-sandboxed process can escape signal delivery restrictions and disrupt or terminate arbitrary processes reachable under standard Unix permissions.

Affected Products

FreeBSD 14.3 (base and patches p1 through p14)
FreeBSD 14.4 (base and patches p1 through p5)
FreeBSD 15.0 (base and patches p1 through p9)

Discovery Timeline

2026-06-27 - CVE-2026-45259 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-45259

Vulnerability Analysis

Capsicum is FreeBSD's capability and sandbox framework. Processes entering capability mode via cap_enter(2) are restricted to operate only on explicitly delegated capabilities. System calls that would let a sandboxed process affect global namespaces or unrelated processes are either blocked or restricted.

The sigqueue(2) system call sends a signal along with a value to a target process identified by PID. In capability mode, the intended contract is that signal delivery must target only the calling process's own PID. The kernel entry point kern_sigqueue failed to enforce this constraint. The classification is a privilege management flaw [CWE-266].

Exploitation requires an attacker to already control code executing inside a Capsicum sandbox. The attacker invokes sigqueue(2) with an arbitrary target PID and a chosen signal number, and the kernel delivers the signal subject only to standard Unix permission checks rather than the stricter Capsicum policy.

Root Cause

The root cause is a missing capability mode check in kern_sigqueue. Sibling signal delivery paths such as kill(2) include logic that rejects targets other than the caller's own PID when the process is in capability mode. This check was never added to the sigqueue(2) path, so the syscall inherited the standard Unix signal permission model inside the sandbox.

Attack Vector

The attack vector is local and requires an already-compromised process inside a Capsicum sandbox. The attacker calls sigqueue(pid, signo, value) with any PID reachable under Unix permissions. Signals such as SIGKILL and SIGSTOP cannot be caught or ignored, giving the attacker a reliable way to terminate or suspend other processes. A sandboxed superuser process can affect any process on the system. No verified public exploit code has been published for CVE-2026-45259.

Detection Methods for CVE-2026-45259

Indicators of Compromise

Unexpected SIGKILL or SIGSTOP delivery to processes that have no shared parent with the sender, especially when the sender is a service known to enter capability mode.
Unexplained termination of daemons or worker processes on hosts running services that use Capsicum sandboxing.
Audit records showing sigqueue invocations from sandboxed processes targeting PIDs other than the caller's own.

Detection Strategies

Enable FreeBSD auditd(8) with a policy that records sigqueue system calls and correlate the caller PID against the target PID.
Use DTrace probes on the kern_sigqueue entry point to log calls where the caller is in capability mode and the target PID differs from the caller PID.
Monitor process lifecycle telemetry for abnormal termination sequences that begin with a signal originating from a sandboxed process.

Monitoring Recommendations

Baseline which services on the host enter Capsicum mode and alert on any signal-driven termination attributable to those services.
Ship kernel audit trails to a centralized log platform and build alerts on sigqueue calls from capability-mode processes to non-self PIDs.
Track FreeBSD patch level across the fleet and flag hosts still running vulnerable 14.3, 14.4, or 15.0 releases.

How to Mitigate CVE-2026-45259

Immediate Actions Required

Apply the fix published in the FreeBSD Security Advisory FreeBSD-SA-26:28.capsicum to all affected hosts.
Inventory services that use cap_enter(2) and prioritize patching hosts where sandboxed services run as root or handle untrusted input.
Restart affected services after applying the kernel update to ensure the corrected kern_sigqueue path is in effect.

Patch Information

FreeBSD has issued a security advisory addressing the missing capability mode check in kern_sigqueue. Refer to the FreeBSD Security Advisory for the errata patch, source patch, and instructions covering FreeBSD 14.3, 14.4, and 15.0 branches. Rebuild the kernel from the updated source or apply the binary update via freebsd-update where supported for the release.

Workarounds

Run sandboxed services under a dedicated unprivileged user with no other processes owned by that UID to limit the set of reachable targets.
Avoid running Capsicum-sandboxed processes as the superuser, since a superuser sandbox can signal any process on the host.
Where feasible, isolate high-risk services in jails or virtual machines so a signal-based disruption cannot reach unrelated workloads.

bash

# Apply the FreeBSD security update and reboot
freebsd-update fetch
freebsd-update install
shutdown -r now