CVE-2026-45257 BUMSRAKETE Post-LPE Kernel Module Load or Root Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects post-exploitation activities related to the CVE-2026-45257 BUMSRAKETE vulnerability on FreeBSD. The rule monitors for kernel module loading using kldload from suspicious directories, kldstat execution, unauthorized root-level crontab modifications, and suspicious root-level shell execution spawned from non-standard parent processes, all of which indicate potential persistence or rootkit installation following a local privilege escalation.