A use‑after‑free flaw exists in the FreeBSD kernel IPv6 multicast filtering code. The kernel releases a serialized lock while copying a list of source filters from user space, then re‑acquires the lock. During this interval another thread may free the multicast filter structure, leaving the kernel with a stale pointer that can be dereferenced. The flaw allows any unprivileged local user to trigger an access to freed memory and potentially gain root privileges.

FreeBSD operating systems running the kernel with the IPV6_MSFILTER socket option enabled are affected. The issue is present in all current releases of the FreeBSD kernel that have not yet been patched by the vendor.

The vulnerability provides a local privilege escalation path and has no known publicly available exploits. As the EPSS score is not available, the exploit probability cannot be quantified, but the impact is a full compromise of the host should an attacker successfully execute the flaw. The lack of a KEV listing indicates that no confirmed exploitation has been reported in the wild.