FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

FreeBSD-kernel -- ASLR bypass for setuid executables via procctl(2)

Affected packages
15.0 <= FreeBSD-kernel < 15.0_10
14.4 <= FreeBSD-kernel < 14.4_6
14.3 <= FreeBSD-kernel < 14.3_15

Details

VuXML ID 7e61007e-6474-11f1-958d-bc241121aa0a
Discovery 2026-06-09
Entry 2026-06-10

Problem Description:

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen.

Impact:

An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitation of any separate memory corruption vulnerability in that binary significantly easier.

References

CVE Name CVE-2026-49414
FreeBSD Advisory SA-26:32.elf