CVE-2026-45257

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS on the transmit side, the file-backed mbufs reach the receiver's decryption path unchanged. Decrypting a record in place then overwrites the backing file's page cache instead of a private copy of the data. An unprivileged local user who can read a file can overwrite its contents with data of their choosing by sending the file over a loopback connection on which they have enabled KTLS receive. The write modifies the page cache directly, so it bypasses file flags such as schg and is written back to disk. By overwriting a setuid binary or other trusted file, a local user can escalate privileges, potentially gaining full control of the affected system.

• CWE-123

• https://security.freebsd.org/advisories/FreeBSD-SA-26:26.ktls.ascVendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/10/20Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/06/10/21Mailing List, Third Party Advisory
• https://www.heise.de/en/news/FreeBSD-Privilege-Escalation-Vulnerability-with-Tongue-in-Cheek-Codename-11329109.htmlThird Party Advisory

Published

Jun 26, 2026

Last Modified

Jun 27, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45251A file descriptor can be closed while a thread is blocked in…7.8
• CVE-2026-45252When a fusefs file system implements extended attributes, th…5.5
• CVE-2026-45253ptrace(PT_SC_REMOTE) failed to properly validate parameters …8.4
• CVE-2026-45254In the case of the cap_net service, when a key present in th…6.5
• CVE-2026-45255When bsdinstall or bsdconfig are prompted to scan for nearby…7.5
• CVE-2026-45256When used to deliver a signal to a specific thread, thr_kill…5.5
• CVE-2026-45258dsp_mmap_single() validated the requested mapping by checkin…7.8
• CVE-2026-45259sigqueue(2) was marked as permitted in capability mode with …6.5
• CVE-2026-4526In EmberZNet v9.0.2 and earlier, malformed global ZCL messag…6.5
• CVE-2026-45260Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2026-45261GitButler is a modern Git-based version control interface fo…9.3
• CVE-2026-45264Nextcloud is an open source content collaboration platform. …4.3