[Midnightbsd-cvs] [MidnightBSD/src] 65b235: Kernel use-after-free via file descriptor syscalls

[Lucas Holt]

  Branch: refs/heads/stable/4.0
  Home:   https://github.com/MidnightBSD/src
  Commit: 65b2357558e759eb737559f9c8e19053d4c780a9
      https://github.com/MidnightBSD/src/commit/65b2357558e759eb737559f9c8e19053d4c780a9
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-06-01 (Mon, 01 Jun 2026)

  Changed paths:
    M sys/dev/netmap/netmap_freebsd.c
    M sys/kern/sys_procdesc.c
    M sys/sys/procdesc.h

  Log Message:
  -----------
  Kernel use-after-free via file descriptor syscalls

A file descriptor can be closed while a thread is blocked in a poll(2) or
select(2) call waiting for that descriptor.  Because the blocked thread does
not hold a reference to the underlying object, this closure may result in the
object being freed while the thread remains blocked.  In this situation, the
kernel must remove the blocked thread from the per-object wait queue prior to
freeing the object.

In the case of some file descriptor types, the kernel failed to unlink
blocked threads from the object before freeing it.  When the blocked thread
is subsequently woken, it accesses memory that has already been freed
resulting in a use-after-free vulnerability.

CVE-2026-45251

Obtained from: FreeBSD 14.x

Does not include tests



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications