During a fork, the kernel copies knote objects for kqueue. When a timer‑based knote fires while this copy is underway, the knote can be enqueued twice, corrupting the active list. Because the copy routine does not lock the structure or verify state, the list corruption leads to a use‑after‑free in the kernel. The weakness is classified as CWE‑416 and enables an unprivileged local user to gain elevated privileges.

The affected vendor is FreeBSD; the vulnerability is in the FreeBSD kernel kqueue subsystem. No specific version ranges are listed, so any kernel build that has not applied the vendor’s patch is potentially vulnerable.

The CVSS score of 8.4 indicates high severity. The EPSS score is below 1 %, showing a low probability of exploitation at present, and the issue is not in the CISA KEV catalog. Nevertheless, because the attack requires only local access and can be triggered by any unprivileged user, the risk of privilege escalation remains significant for administrators. Prompt remediation is advisable.