BUMSRAKETE CVE-2026-45257: kTLS-RX Socket Option Set by Unprivileged Process on FreeBSD

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.