This vulnerability lies in the kqueue copy‑on‑fork logic of FreeBSD. When a process forks, the function kqueue_fork_copy_knote() indexes into the child’s file‑descriptor table using a knote’s file‑descriptor number without performing a bounds check. Because the child’s table is copied before any knotes are transferred, a concurrently executing parent thread can grow its own table and register knotes that reference file‑descriptor numbers beyond the child’s table bounds. The result is an out‑of‑bounds read, which an unprivileged local user can exploit to read kernel memory and potentially gain elevated privileges. The flaw reflects a buffer under‑read weakness (CWE‑125) and a race condition (CWE‑362). The impact is the potential for a local privilege escalation attack against any FreeBSD system that uses the affected kqueue implementation; an attacker with local code execution privileges could read sensitive kernel data or manipulate process credentials. Because the exploit relies on a race between fork and knote registration, it requires a sufficient race window and concurrent activity on the target machine, but the absence of a bounds check makes the vulnerability highly exploitable once the timing is achieved.

The issue affects all FreeBSD systems as identified by the CNA vendor/product list. No specific firmware or kernel version numbers are supplied in the advisory, so all supported releases containing the vulnerable kqueue copy‑on‑fork code are potentially affected.

The advisory lists a CVSS score of 7, indicating medium severity, and an EPSS score of less than 1%. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, the defect—a missing bounds check coupled with a race condition—creates a high‑impact vector: a local user can trigger an out‑of‑bounds read and possibly elevate privileges. Exploitation requires concurrent local activity on the system, but the lack of a public exploit does not reduce the inherent risk of privilege escalation.