The vulnerability in FreeBSD’s hwpmc subsystem results from an inverted check that fails to detach hardware performance monitoring counters (PMCs) when a process performs an execve(2) with setuid or setgid. As a consequence, an unprivileged local user who has already attached PMCs to a process continues to receive monitoring data even after the target process upgrades to a privileged executable. This allows the unprivileged user to observe privileged memory spaces, kernel activity, or sensitive timing information, violating the intended isolation policy. The weakness is identified as CWE‑273, which is improper permission assignment.

The issue affects the FreeBSD operating system. Any installation that has the hwpmc(4) device active and allows user processes to attach counters is susceptible. No specific FreeBSD release numbers are listed, so the vulnerability applies to all versions that ship hwpmc without the fix issued in the FreeBSD-SA‑26:56 advisory.

This flaw is exploitable from the local machine by an ordinary user without administrative rights. Because the attack requires only the ability to attach PMCs, which is normally permitted, the path is straightforward. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating that no large‑scale exploitation has been observed to date. Nevertheless, an attacker can gain continuous access to privileged process telemetry, which can be leveraged for covert monitoring or to bypass certain security controls. The CVSS score is not provided; however, the policy violation and potential for information leakage suggest a high impact. The safest response is to apply the vendor’s fix promptly.