Improper Signal Management in FreeBSD Affecting User Processes

CVE-2026-45256

What is CVE-2026-45256?

A flaw in FreeBSD's signal management system allows an unprivileged local user to signal processes and threads without proper permission checks. By leveraging the thr_kill2 system call, an attacker can send signals to processes owned by other users or root, including critical system services, which can lead to unexpected termination of processes and result in Denial of Service attacks. This issue arises from the failure to validate access rights adequately before delivering signals, enabling potential exploitation through brute-force discovery of thread IDs. As a consequence, users operating in restricted environments can interfere with processes outside their intended jurisdiction, compromising system stability.

References