TIOCNOTTY ハンドラにおける Kernel use-after-free バグ

An attacker can exploit this vulnerability to escalate their privileges to root on the affected system. The attack involves leveraging a dangling pointer resulting from the TIOCNOTTY function's failure to clear a back-pointer to the calling process' session. After the process exits, the terminal structure retains a pointer to freed memory. A malicious process can then manipulate this dangling pointer to execute arbitrary code with root privileges, effectively gaining complete control over the system. This represents a significant security risk, potentially allowing attackers to compromise the entire system and access sensitive data.

Systems running FreeBSD Kernel 13.5-RELEASE–p12 are at risk. This includes servers, workstations, and embedded devices utilizing this kernel version. Environments with limited access controls or those running untrusted code are particularly vulnerable.

• linux / server:

journalctl -g 'TIOCNOTTY' --since "1 week ago"

• linux / server:

ps aux | grep -i 'tiocnotty'

• linux / server:

find / -type f -name '*tiocnotty*' 2>/dev/null

1. 2026-04-22Disclosure

   disclosure

1. 予約済み2026-04-02
2. 公開日2026-04-22
3. 更新日2026-04-23
4. EPSS 更新日2026-04-29

The primary mitigation for CVE-2026-5398 is to upgrade to FreeBSD Kernel version 13.5-RELEASE–p12, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting access to the TIOCNOTTY function or implementing stricter process isolation. While a direct WAF rule is unlikely to be effective, monitoring system logs for unusual process behavior and memory access patterns can provide early detection. After upgrade, confirm by verifying the kernel version using uname -r and ensuring it reports 13.5-RELEASE–p12.