CVE-2026-45253: Missing validation in ptrace(PT_SC_REMOTE)
ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45253?
CVE-2026-45253 has a high severity score of 8.4 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-45253?
To fix CVE-2026-45253, update to the latest version of FreeBSD that addresses this vulnerability.
What are the potential impacts of CVE-2026-45253?
CVE-2026-45253 can lead to arbitrary code execution in the kernel for users with debugging capabilities, compromising system integrity.
Which systems are affected by CVE-2026-45253?
CVE-2026-45253 affects FreeBSD systems where the ptrace(PT_SC_REMOTE) syscall is utilized.
How does CVE-2026-45253 allow arbitrary code execution?
CVE-2026-45253 allows arbitrary code execution due to insufficient validation of parameters in syscall(2) and __syscall(2) calls.