CVE-2026-45256

When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but did not check the result before delivering the signal. The signal was sent even when the permission check failed. The system call returned the resulting error to the caller, but by then the signal had already been delivered. The missing check allows an unprivileged local user who knows or can guess a target's process and thread IDs to send any signal to a process they would not normally be permitted to signal, including processes owned by other users or by root. The same check enforces jail boundaries, so a jailed process can signal processes on the host or in other jails. Thread IDs are allocated globally and sequentially, and so can be discovered by brute force with no visibility into the target. An attacker can stop or terminate arbitrary processes, including critical system daemons, resulting in a Denial of Service (DoS).

• CWE-269

• https://security.freebsd.org/advisories/FreeBSD-SA-26:25.thr.ascVendor Advisory

Published

Jun 26, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45250The setcred(2) system call is only available to privileged u…7.8
• CVE-2026-45251A file descriptor can be closed while a thread is blocked in…7.8
• CVE-2026-45252When a fusefs file system implements extended attributes, th…5.5
• CVE-2026-45253ptrace(PT_SC_REMOTE) failed to properly validate parameters …8.4
• CVE-2026-45254In the case of the cap_net service, when a key present in th…6.5
• CVE-2026-45255When bsdinstall or bsdconfig are prompted to scan for nearby…7.5
• CVE-2026-45257The KTLS receive path decrypted each record in place, assumi…7.8
• CVE-2026-45258dsp_mmap_single() validated the requested mapping by checkin…7.8
• CVE-2026-45259sigqueue(2) was marked as permitted in capability mode with …6.5
• CVE-2026-4526In EmberZNet v9.0.2 and earlier, malformed global ZCL messag…6.5
• CVE-2026-45260Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2026-45261GitButler is a modern Git-based version control interface fo…9.3