A use‑after‑free condition exists in the FreeBSD kernel when a file descriptor is closed while a thread is blocked in poll(2) or select(2). The closed descriptor is freed before the blocked thread is removed from its wait queue, so when the thread is later awakened it accesses memory that has already been reclaimed. The exposed memory read constitutes a use‑after‑free flaw (CWE‑416) and can be leveraged by an unprivileged local user to gain superuser privileges.

The vulnerability affects the FreeBSD operating system; vendor and product information indicates only the FreeBSD base system. No specific version or patch level is listed, so users should verify whether their installed FreeBSD release is among the affected ones and stay current with vendor updates.

The flaw is local only, requiring the attacker to run as a normal user on the target machine. Because the exploit can elevate privileges to root, the high CVSS score of 7.8 indicates a serious risk. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to open a file descriptor, wait on it with poll/select, then close it, which is feasible within a local session.