Executive Summary

CVE-2026-2261 is a vulnerability in the blocklistd service of FreeBSD 15.0 caused by a programming error that leaks a socket descriptor for each adverse event report processed.

As these leaked sockets accumulate, blocklistd eventually fails to run its helper script because a forked child process crashes due to dereferencing a null pointer before executing the helper.

At this point, blocklistd continues to log adverse events but cannot block new IP addresses or unblock expired ones. If the leakage continues further, blocklistd becomes unable to receive new adverse event reports altogether.

This resource leak can cause blocklistd to become ineffective and may also slow down the system until blocklistd is restarted.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'An attacker can exploit this vulnerability by triggering many adverse events from disposable IP addresses, causing blocklistd to exhaust its socket descriptors and disable its blocking functionality.'}, {'type': 'paragraph', 'content': "This effectively disables blocklistd's ability to block malicious IPs, potentially allowing further attacks to succeed."}, {'type': 'paragraph', 'content': 'Even without an attack, normal operations will gradually leak sockets, causing blocklistd to become ineffective over time and potentially slowing down the system.'}, {'type': 'paragraph', 'content': 'A temporary mitigation is to regularly restart blocklistd, but this does not fully protect against attackers using many sacrificial IPs.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring the number of open socket descriptors used by the blocklistd service. An unusually high or steadily increasing count of open sockets associated with blocklistd indicates the presence of the socket descriptor leak.'}, {'type': 'paragraph', 'content': 'You can use system commands to check open file descriptors and sockets for the blocklistd process. For example:'}, {'type': 'list_item', 'content': "Use 'sockstat' to list open sockets by blocklistd: sockstat -c -p $(pgrep blocklistd)"}, {'type': 'list_item', 'content': "Use 'lsof' to list open files and sockets for blocklistd: lsof -p $(pgrep blocklistd)"}, {'type': 'list_item', 'content': 'Check the number of open file descriptors for blocklistd: ls /proc/$(pgrep blocklistd)/fd | wc -l (if /proc is available)'}, {'type': 'paragraph', 'content': 'A growing number of open sockets or file descriptors over time without release suggests the vulnerability is active.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to regularly restart the blocklistd service to release leaked socket descriptors and restore its blocking functionality.

However, this is only a temporary workaround and may not be sufficient against attackers who deliberately trigger many adverse events.

The recommended permanent solution is to upgrade FreeBSD to a version that includes the fix for this vulnerability. This fix is available in the stable/15 and releng/15.0 branches after 2026-02-10.

Updates can be applied using pkg(8) for systems installed from base packages, freebsd-update(8) for binary distribution sets, or by applying a verified source patch followed by recompilation.

Useful 0 Not Useful 0