BUMSRAKETE CVE-2026-45257 FreeBSD kTLS-RX SUID Binary Overwrite LPE

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.