The vulnerability in FreeBSD’s hwpmc subsystem results from an inverted check that fails to detach hardware performance monitoring counters (PMCs) when a process performs an execve(2) with setuid or setgid. As a consequence, an unprivileged local user who has already attached PMCs to a process continues to receive monitoring data even after the target process upgrades to a privileged executable. This allows the unprivileged user to observe privileged memory spaces, kernel activity, or sensitive timing information, violating the intended isolation policy. The weakness is identified as CWE‑273, which is improper permission assignment.

The issue affects the FreeBSD operating system. Any installation that has the hwpmc(4) device active and allows user processes to attach counters is susceptible. No specific FreeBSD release numbers are listed, so the vulnerability applies to all versions that ship hwpmc without the fix issued in the FreeBSD-SA‑26:56 advisory.

This flaw is exploitable from the local machine by an ordinary user without administrative rights. Because the attack requires only the ability to attach PMCs, which is normally permitted, the path is straightforward. The EPSS score of 0.00154 indicates a very low probability of exploitation in the wild, yet the vulnerability is still severe due to its potential for continuous privileged process monitoring. The CVSS score of 7.8 reflects significant confidentiality and integrity impact. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale exploitation has been observed to date, but the risk remains high for systems where the hwpmc(4) interface is used.