CVE-2026-5398: Privilege Escalation in FreeBSD Kernel

An attacker can exploit this vulnerability to escalate their privileges to root on the affected system. The attack involves leveraging a dangling pointer resulting from the TIOCNOTTY function's failure to clear a back-pointer to the calling process' session. After the process exits, the terminal structure retains a pointer to freed memory. A malicious process can then manipulate this dangling pointer to execute arbitrary code with root privileges, effectively gaining complete control over the system. This represents a significant security risk, potentially allowing attackers to compromise the entire system and access sensitive data.

1. Reserved2026-04-02
2. Published2026-04-22
3. Modified2026-04-23
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-5398 is to upgrade to FreeBSD Kernel version 13.5-RELEASE–p12, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting access to the TIOCNOTTY function or implementing stricter process isolation. While a direct WAF rule is unlikely to be effective, monitoring system logs for unusual process behavior and memory access patterns can provide early detection. After upgrade, confirm by verifying the kernel version using uname -r and ensuring it reports 13.5-RELEASE–p12.