CVE-2026-45251— FreeBSD 资源管理错误漏洞

Kernel use-after-free via file descriptor syscalls

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed while the thread remains blocked. In this situation, the kernel must remove the blocked thread from the per-object wait queue prior to freeing the object. In the case of some file descriptor types, the kernel failed to unlink blocked threads from the object before freeing it. When the blocked thread is subsequently woken, it accesses memory that has already been freed resulting in a use-after-free vulnerability. The use-after-free vulnerability may be triggered by an unprivileged local user and can be exploited to obtain superuser privileges.

N/A

释放后使用

FreeBSD 资源管理错误漏洞

FreeBSD是FreeBSD基金会的一套类Unix操作系统。 FreeBSD存在资源管理错误漏洞，该漏洞源于文件描述符关闭时线程阻塞在poll或select调用中，内核在释放对象前未能从对象等待队列中移除阻塞线程，导致释放后重用，可能被无特权本地用户触发并利用获取超级用户权限。

N/A

N/A