Executive Summary

This vulnerability exists in the FreeBSD fusefs kernel module when it handles extended attributes via the FUSE_LISTXATTR message. The kernel expects a list of NUL-terminated strings from the userspace daemon, but it does not verify that the entire list is properly NUL-terminated before calling strlen() on it.

If a malicious daemon sends a list that is not NUL-terminated, the kernel module may read beyond the end of one heap-allocated buffer and potentially write beyond the end of another buffer. This can lead to disclosure of up to 253 bytes of kernel heap memory or injection of up to 250 attacker-controlled bytes into unallocated kernel heap space.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a malicious userspace daemon to either read sensitive kernel heap memory or inject malicious data into kernel memory. Specifically, it can disclose up to 253 bytes of kernel heap memory, potentially leaking sensitive information, or write up to 250 bytes of attacker-controlled data into unallocated kernel heap space, which could lead to further exploitation or system instability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade their FreeBSD systems to the patched versions in stable/15, stable/14, or their respective release branches with fixes applied after May 20, 2026.

After upgrading, a system reboot is necessary to apply the fixes.

If your system does not use the fusefs module or has vfs.usermount disabled, it is unaffected by this vulnerability.

Upgrades can be performed using pkg, freebsd-update, or by applying source code patches.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.

Useful 0 Not Useful 0