FreeBSD kTLS-RX arbitrary file overwrite local privilege escalation

CVE-2026-45257 is a local privilege escalation vulnerability in FreeBSD’s Kernel TLS (kTLS) receive path. The flaw arises from unsafe interaction between sendfile(2), unprivileged TCP_RXTLS_ENABLE, and in-place AES-GCM decryption on vnode-backed M_EXTPG/EXTPG mbufs. In the vulnerable path, sendfile(2) can produce mbufs whose page references point directly at the backing page-cache pages of a readable file. An unprivileged user can then enable kTLS receive on a TCP socket they control, send the file over a loopback connection, and cause in-place decryption to operate on those file-backed pages through the kernel direct map (DMAP). Because the attacker controls the TLS keying material and knows the original file contents, they can choose the resulting plaintext bytes written into the page-cache page. The write bypasses normal VFS-mediated permission enforcement and can affect any file the attacker can read. Reported affected versions include FreeBSD 13.0 through 13.4, 14.0 through 14.2, and 15.0-RELEASE; FreeBSD 12.x and earlier are reported as not affected. MidnightBSD 4.0+ was also noted as impacted.