The flaw emerges when the thr_kill2(2) system call fails to honor the result of a permission check performed by p_cansignal(). As a consequence, signals are delivered even when the calling process lacks the necessary rights. This oversight permits an unprivileged local user to send arbitrary signals to any thread specified by its globally unique identifier, regardless of owner or jail boundaries. The impact is the ability to stop or terminate arbitrary processes, which can include critical system daemons, thereby causing a denial of service or enabling further escalation depending on the target process. Based on the description, it is inferred that the missing check directly causes undesired signal delivery.

The vulnerability applies to the FreeBSD operating system. All releases before the patch that fixed the missing check in thr_kill2(. The exact affected versions are not enumerated in the advisory, but any installation of not applied the advertised fix is at risk.

The likely attack vector is local exploitation on the same host by an unprivileged user who knows or can guess the target's process and thread IDs. By brute‑forcing sequentially allocated thread IDs, an attacker can discover the necessary identifiers with no visibility into the target. Once the IDs are known, the exploit is trivial: craft a thr_kill2(2) call to any desired signal. The exploit probability is high in environments where local users have shell access and the system lacks restrictive controls on signal handling. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it was not yet widely exploited. However, the simplicity of the attack vector and the potential for DoS justify urgent remediation.