Description
The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory.
An unprivileged local user can exploit this use-after-free to escalate privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FreeBSD | FreeBSD | 15.0-RELEASE – < p10, 14.4-RELEASE – < p6, 14.3-RELEASE – < p15 | p10 |
Advisories 1
- WID-SEC-2026-1871 FreeBSD Project FreeBSD OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026