The vulnerability is a race condition and use‑after‑free in the FreeBSD kqueue copy‑on‑fork path. When a parent process’s kqueue knotes are in a fork, marker knotes are not correctly removed before the kqueue lock is released. If a concurrent thread frees a marker while the lock is dropped, the subsequent in‑flux decrement operates on freed memory. This flaw can be triggered by an unprivileged local user and may allow that user to elevate privileges to an arbitrary level, potentially root. The weakness is characterized by the Common Weakness Enumerations for Race Condition (CWE‑362) and Use After Free (CWE‑416).

The flaw resides in the FreeBSD operating system, affecting the kqueue subsystem. No specific release or version was listed in the advisory, so all potentially vulnerable FreeBSD installations that have not applied the patch identified in the FreeBSD Security Advisory (FreeBSD‑SA‑26:65.kqueue) are at risk.

Exploitation requires a local account and the presence of concurrent threads that can free a kqueue marker during the race. The EPSS score of <1% indicates that exploitation is unlikely to have occurred publicly, yet local attacks remain feasible, and the vulnerability is not listed in the CISA KEV catalog. Because privilege escalation is possible, the risk is significant. Attacks would likely be performed by a local attacker with sufficient process‑level concurrency to trigger the race, enabling them to gain elevated privileges. The CVSS score of 7 indicates high severity.