lpe

A critical local privilege escalation vulnerability in FreeBSD (CVE-2026-45257) allows an unprivileged user to write arbitrary data into the page cache of any readable file, bypassing file permissions and flags, leading to full root compromise. The bug affects default installations of FreeBSD 13.0 and later via unsafe composition of sendfile, KTLS, and in-kernel AES-GCM decryption.

A kernel stack buffer overflow in FreeBSD 14.x's setcred(2) system call allows any unprivileged local user to escalate privileges to root, even with SMAP/SMEP enabled. The bug is not yet fixed in stable branches.