Home

Description

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges.

PUBLISHED Reserved 2026-04-28 | Published 2026-04-30 | Updated 2026-04-30 | Assigner freebsd

Problem types

CWE-783: Operator Precedence Logic Error

Product status

Default status
unknown

15.0-RELEASE (release) before p7
affected

14.4-RELEASE (release) before p3
affected

14.3-RELEASE (release) before p12
affected

13.5-RELEASE (release) before p13
affected

Credits

Ryan Austin of Calif.io finder

References

security.freebsd.org/advisories/FreeBSD-SA-26:13.exec.asc vendor-advisory

cve.org (CVE-2026-7270)

nvd.nist.gov (CVE-2026-7270)

Download JSON