BUMSRAKETE CVE-2026-45257 chflags schg Bypass via DMAP Page-Cache Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.