Executive Summary

CVE-2026-4747 is a critical vulnerability in FreeBSD's RPCSEC_GSS implementation that allows unauthenticated remote attackers to execute code. The issue arises because a routine that validates RPCSEC_GSS data packets copies part of the packet into a fixed-size stack buffer without checking if the buffer is large enough. This leads to a stack-based buffer overflow.

The vulnerability affects both the kernel module kgssapi.ko, used by the NFS server, and userspace applications using the librpcgss_sec library. In the kernel, an attacker can send crafted packets to trigger remote code execution if the kgssapi.ko module is loaded. In userspace, any RPC server linked with librpcgss_sec is vulnerable to remote code execution from any client able to send packets, although no such vulnerable applications are known in the FreeBSD base system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on affected FreeBSD systems without requiring the attacker to authenticate first.

• In the kernel, if the kgssapi.ko module is loaded, a malicious client can send specially crafted packets to the NFS server to execute arbitrary code with kernel privileges.
• In userspace, any RPC server linked with the librpcgss_sec library can be exploited by remote attackers to execute arbitrary code, although no such vulnerable applications are known in the FreeBSD base system.

Systems without the kgssapi.ko module loaded are not vulnerable. There is no workaround other than upgrading to patched versions or ensuring the vulnerable module is not loaded.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability exists in the FreeBSD kernel module kgssapi.ko and in userspace applications linked with librpcgss_sec. Detection involves checking if the kgssapi.ko module is loaded on your system, as systems without this module loaded are not vulnerable.

To detect if the vulnerable kernel module is loaded, you can use the following command on FreeBSD systems:

• kldstat | grep kgssapi

If the output shows kgssapi.ko loaded, your system is potentially vulnerable.

Additionally, monitoring network traffic for suspicious or malformed RPCSEC_GSS packets targeting the NFS server could help detect exploitation attempts, but no specific detection commands or signatures are provided.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to ensure that the vulnerable kgssapi.ko kernel module is not loaded on your system, as systems without this module loaded are not vulnerable.

If the module is required, immediate steps include upgrading your FreeBSD system to a patched version released after March 26, 2026.

• Use 'pkg upgrade' if your system was installed from base system packages.
• Use 'freebsd-update' if your system was installed from binary distribution sets.
• Alternatively, apply the verified source code patches provided in the advisory, then recompile and reboot your system.

No other workarounds exist besides removing the module or applying the patches and updates.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-4747 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0