Executive Summary
A critical vulnerability named BUMSRAKETE (CVE-2026-45257) has been identified in FreeBSD versions 13.0 through 15.0-RELEASE. This flaw allows an unprivileged local attacker to bypass system file permissions, including immutable flags (chflags schg), by writing directly into the kernel's page cache through the Direct Map (DMAP). The vulnerability is the FreeBSD equivalent of the Linux 'Dirty Pipe' bug and provides a highly reliable path to local privilege escalation.
The attack leverages the unsafe composition of three kernel subsystems: sendfile(2) creating vnode-backed mbufs, unprivileged access to software kTLS RX socket options, and in-place AES-GCM decryption. By looping sendfile data through a local TCP socket with attacker-controlled kTLS keys, an adversary can overwrite the page cache of any readable file with arbitrary data. This is demonstrated in the wild by a proof-of-concept (bumsrakete.c) that injects shellcode into SUID-root binaries to obtain root shells in under 1.5 seconds.
This vulnerability impacts any multi-tenant FreeBSD deployment, including hosting providers and jail-based environments, where the default 'kern.ipc.mb_use_ext_pgs=1' sysctl is enabled. Organizations should prioritize applying the official security patch FreeBSD-SA-26:26.ktls or implementing the recommended sysctl mitigation immediately.