CVE-2026-45256

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A flaw exists where the thr kill2(2) system call invokes p cansignal() to verify signal delivery permissions but fails to validate the result before sending the signal. This allows an unprivileged local user to send signals to processes they are not permitted to access, including those owned by root or other users. This issue also bypasses jail boundaries, enabling a jailed process to signal processes on the host or in other jails. Because thread IDs are allocated globally and sequentially, they can be discovered via brute force. An attacker can exploit this to stop or terminate arbitrary processes, including critical system daemons, leading to a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.