BUMSRAKETE CVE-2026-45257: FreeBSD sendfile kTLS Loop Privilege Escalation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.