CVE-2026-45257 BUMSRAKETE: FreeBSD kTLS-RX Vulnerable Sysctl Enumeration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects reconnaissance activity on FreeBSD systems by monitoring the execution of 'sysctl', 'uname', 'freebsd-version', and 'pkg' to query sensitive kernel parameters and system version information. Specifically, it flags queries related to CVE-2026-45257 (BUMSRAKETE), such as 'kern.ipc.mb_use_ext_pgs' and 'kern.tls.enable'. The rule differentiates risk levels based on the combination of targeted kernel parameter checks and system version enumeration.