We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 11·5 min read
CVE-2026-45257: LPE in FreeBSD via kTLS-RX
TL;DR
A significant vulnerability, CVE-2026-45257, exists in FreeBSD that allows unprivileged users to write unauthorized data into the page-cache of files they can read. This flaw bypasses standard file permission checks by directly accessing the kernel's memory mapping.
✦ Why It Matters
Engineers must apply the patch to FreeBSD systems to prevent unauthorized data manipulation and potential security breaches.
Key Takeaways
- Update FreeBSD systems to the latest version immediately.
- Review file permission settings to mitigate risks.
- Monitor for unusual access patterns in system logs.
- Educate teams about the implications of kernel vulnerabilities.
Full Summary
CVE-2026-45257 is a critical local privilege escalation (LPE) vulnerability found in FreeBSD, specifically affecting versions 13.0 and later on various architectures like amd64 and arm64. The flaw, dubbed BUMSRAKETE, allows unprivileged users to write attacker-controlled bytes into the page-cache of any file they have read access to, circumventing normal file permission checks.
This occurs because the write operation bypasses the Virtual File System (VFS) layer and directly interacts with the kernel's direct map. The vulnerability poses a severe risk as it can lead to unauthorized data manipulation and potential system compromise.
A patch has been made available to mitigate this issue, emphasizing the importance of timely updates for system security. Engineers and researchers should be aware of this vulnerability to ensure their systems are protected against potential exploits.