A buffer overflow in the FreeBSD routing socket handler rtsock_msg_buffer copies unchecked sockaddr data onto the stack, overwriting a stack canary and causing a kernel panic when the function returns. The crash can be induced by any unprivileged user that can send a crafted routing socket request, resulting in a local denial of service. If a separate kernel flaw later exposes the canary value, the overflow could also be weaponized for local privilege escalation.

FreeBSD releases affected include 13.5 (patches 1 through 9), 14.3 (patches 1 through 8), 14.4 rc1, and 15.0 (patches 1 through 3). All these versions are impacted until the advisory’s fix is applied.

The CVSS score of 7.5 marks the flaw as high severity, yet the EPSS score of <1% indicates an extremely low likelihood of exploitation in the wild. The vulnerability is local; an attacker must be able to run arbitrary code on the target system to send the malicious routing socket message. The flaw is not listed in CISA’s KEV catalog, reinforcing the perception that it is not actively exploited at present.