CVE-2026-2261
Socket Descriptor Leak in blocklistd Causes Denial of Service
Publication date: 2026-03-09
Last updated on: 2026-03-17
Assigner: FreeBSD
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-772 | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2261 is a vulnerability in the blocklistd service of FreeBSD 15.0 caused by a programming error that leaks a socket descriptor for each adverse event report processed.
As these leaked sockets accumulate, blocklistd eventually fails to run its helper script because a forked child process crashes due to dereferencing a null pointer before executing the helper.
At this point, blocklistd continues to log adverse events but cannot block new IP addresses or unblock expired ones. If the leakage continues further, blocklistd becomes unable to receive new adverse event reports altogether.
This resource leak can cause blocklistd to become ineffective and may also slow down the system until blocklistd is restarted.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'An attacker can exploit this vulnerability by triggering many adverse events from disposable IP addresses, causing blocklistd to exhaust its socket descriptors and disable its blocking functionality.'}, {'type': 'paragraph', 'content': "This effectively disables blocklistd's ability to block malicious IPs, potentially allowing further attacks to succeed."}, {'type': 'paragraph', 'content': 'Even without an attack, normal operations will gradually leak sockets, causing blocklistd to become ineffective over time and potentially slowing down the system.'}, {'type': 'paragraph', 'content': 'A temporary mitigation is to regularly restart blocklistd, but this does not fully protect against attackers using many sacrificial IPs.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring the number of open socket descriptors used by the blocklistd service. An unusually high or steadily increasing count of open sockets associated with blocklistd indicates the presence of the socket descriptor leak.'}, {'type': 'paragraph', 'content': 'You can use system commands to check open file descriptors and sockets for the blocklistd process. For example:'}, {'type': 'list_item', 'content': "Use 'sockstat' to list open sockets by blocklistd: sockstat -c -p $(pgrep blocklistd)"}, {'type': 'list_item', 'content': "Use 'lsof' to list open files and sockets for blocklistd: lsof -p $(pgrep blocklistd)"}, {'type': 'list_item', 'content': 'Check the number of open file descriptors for blocklistd: ls /proc/$(pgrep blocklistd)/fd | wc -l (if /proc is available)'}, {'type': 'paragraph', 'content': 'A growing number of open sockets or file descriptors over time without release suggests the vulnerability is active.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to regularly restart the blocklistd service to release leaked socket descriptors and restore its blocking functionality.
However, this is only a temporary workaround and may not be sufficient against attackers who deliberately trigger many adverse events.
The recommended permanent solution is to upgrade FreeBSD to a version that includes the fix for this vulnerability. This fix is available in the stable/15 and releng/15.0 branches after 2026-02-10.
Updates can be applied using pkg(8) for systems installed from base packages, freebsd-update(8) for binary distribution sets, or by applying a verified source patch followed by recompilation.