FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)

Key facts for FreeBSD VNET jail escape

Detection coverage for FreeBSD VNET jail escape

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5118 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FreeBSD CVE-2026-3038 RTSock rtsock_msg_buffer Overflow Kernel Panic (FreeBSoD) — Exploitation

Detects kernel panic / fatal trap messages whose backtrace contains rtsock_msg_buffer, or the stack-protector panic 'stack overflow detected; backtrace may be corrupted'. An unmitigated CVE-2026-3038 overflow triggered by a crafted RTM_GET routing-socket message (invalid RTAX_AUTHOR sockaddr length) corrupts the stack canary and panics the kernel; failed attempts of the FreeBSoD jail-escape chain 1 look the same on unpatched 13.5/14.3/14.4/15.0 hosts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1499.004, T1068
• Data sources: freebsd_syslog, index=os sourcetype=syslog, Syslog table
• Severity: high
• Confidence: medium

Splunk SPL

index=os sourcetype=syslog earliest=-24h ("rtsock_msg_buffer" OR "stack overflow detected; backtrace may be corrupted" OR ("Fatal trap" "rtsock"))
| rex field=_raw "(?<panic_msg>panic: [^\r\n]+)"
| eval cve="CVE-2026-3038", technique="T1499.004"
| stats count min(_time) as first_seen max(_time) as last_seen values(panic_msg) as panic_msg by host cve technique
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("rtsock_msg_buffer", "stack overflow detected; backtrace may be corrupted")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| project Computer, Events, FirstSeen, LastSeen, Sample

Sigma

title: FreeBSD CVE-2026-3038 RTSock Overflow Kernel Panic
id: 5b1c7a52-3d4e-4f6a-9c18-7e2a40d15118
status: experimental
description: Detects kernel panic output referencing rtsock_msg_buffer or a stack-protector failure, consistent with a failed CVE-2026-3038 (RTM_GET routing-socket) exploitation attempt.
references:
    - https://www.freebsd.org/security/advisories/FreeBSD-SA-26:05.route.asc
    - https://www.praetorian.com/blog/llm-kernel-exploit-development/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.impact
    - attack.t1499.004
    - attack.privilege-escalation
    - attack.t1068
    - cve.2026.3038
logsource:
    product: freebsd
    service: syslog
detection:
    keywords:
        - 'rtsock_msg_buffer'
        - 'stack overflow detected; backtrace may be corrupted'
    condition: keywords
falsepositives:
    - Unrelated kernel stack-protector panics from faulty drivers or hardware
    - Kernel developers testing rtsock changes on non-production hosts
level: high

Known false positives:

• Unrelated kernel panics from faulty drivers, hardware faults or other stack-protector failures
• Developers reproducing the CVE on lab hosts

Tuning notes: Index/sourcetype are assumed (FreeBSD /var/log/messages forwarded to index=os); adjust to your environment. Panic backtraces are only logged if the host reboots and savecore/dumpon or a remote console/syslog captures them. Only unpatched hosts (before 13.5-RELEASE-p10, 14.3-RELEASE-p9, 14.4 patch, 15.0-RELEASE-p4) are expected to match; exclude patched lab hosts.

• 🔒 FreeBSD Kernel Exploit Development and Vulnerability Acquisition Activity (FreeBSoD, CVE-2026-3038) — Exploitation · unlock with TL Creds
• 🔒 FreeBSD Unexplained Effective UID Transition to Root (Kernel LPE) — Post-Exploitation · unlock with TL Creds
• 🔒 FreeBSD File-Descriptor Table Growth and Pipe Creation Burst (UMA Heap Grooming) — Exploitation · unlock with TL Creds
• 🔒 FreeBSD Unprivileged AF_ROUTE Routing-Socket Burst (RTM_GET, CVE-2026-3038) — Exploitation · unlock with TL Creds
• 🔒 FreeBSD Kernel Memory Device Access or Kernel Module Load After Privilege Gain — Post-Exploitation · unlock with TL Creds
• 🔒 FreeBSD Audit Subsystem Tampering After Escape (auditd Stop / audit -t) — Defense Impairment · unlock with TL Creds
• 🔒 FreeBSD VNET Jail Escape — Process Jail ID Transition to Host (FreeBSoD) — Post-Exploitation · unlock with TL Creds
• 🔒 FreeBSD KERN_PROC_FILEDESC Sysctl Kernel Address Leak Probing (FreeBSoD) — Discovery/Leak · unlock with TL Creds

Indicators of compromise for FreeBSD VNET jail escape

As of 2026-11-03, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5118.

How FreeBSD VNET jail escape works

Only CVE-2026-3038 is patched (FreeBSD-SA-26:05.route); no in-the-wild exploitation is reported.

CVE-2026-3038 is a stack-based buffer overflow (CWE-787) in rtsock_msg_buffer() in the FreeBSD routing-socket subsystem (sys/net/rtsock.c). The function copies sockaddr data into a fixed-size sockaddr_storage buffer on the stack without validating the source length for one sockaddr slot, letting an unprivileged local user trigger an overflow of up to 127 bytes via a crafted RTM_GET routing-socket message. On its own this corrupts the adjacent stack canary and causes a kernel panic (local denial of service). Praetorian Labs researcher Adam Crosser reported the bug to the FreeBSD security team on 2026-02-23; FreeBSD shipped FreeBSD-SA-26:05.route the next day (2026-02-24) with patches for all supported branches (13.5, 14.3, 14.4, 15.0) and no interim workaround. NVD rates it CVSS 3.1 7.5 (HIGH), AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Praetorian's two-part FreeBSoD series describes using an LLM coding agent across the full vulnerability-research lifecycle on FreeBSD. Part 1 (published 2026-06-17) covered discovery: the agent researched known FreeBSD kernel bug classes, generated CodeQL/semgrep rules from those patterns, swept kernel subsystems (scoped to 30,000-40,000 lines of code to fit context windows, including jail and VNET-exposed networking code), and validated candidate bugs against a KASAN-instrumented FreeBSD test VM used as an automated oracle. Roughly eight distinct issues were reported to FreeBSD's volunteer security team from this work; only CVE-2026-3038 has been publicly disclosed and patched, with the remainder described as awaiting remediation.

Part 2 (published 2026-07-06) describes turning two of the discovered bug combinations into working, reliable kernel-to-root exploit chains that escape a FreeBSD VNET jail, using a staged L0-L4 development methodology (crash detection, instruction-pointer control, end-to-end exploitation, mitigation-bypass integration, full weaponization) that gave the agent isolated, single-variable debugging signals at each stage. Both chains combine an undisclosed kernel stack information-disclosure bug (used to defeat stack-canary and KASLR protections) with a memory-corruption primitive to gain kernel code execution, then disable the CPU's SMEP/SMAP protections and pivot control flow to attacker-supplied kernel-mode logic that escalates the calling process's credentials to root, detaches it from its jail, and restores host-level filesystem/network visibility, completing a jail escape. Chain 1 uses the patched CVE-2026-3038 RTSock overflow as its memory-corruption primitive; Chain 2 instead uses an unpatched heap overflow in a kernel message-parsing interface combined with heap-grooming techniques (driving a kernel allocation zone into an attacker-influenced layout via repeated resource-table growth) and a type-confusion bug between two unrelated kernel object types that lets the attacker control the dispatch table used by follow-on system calls. Praetorian withheld implementation-level detail on the still-unpatched info-leak and heap-overflow bugs specifically to avoid enabling mass exploitation while patches are pending.

The research frames the agent's contribution and limits: it independently reasoned about kernel internals well enough to identify a memory-allocator caching behavior and a kernel file-descriptor-table structure as a grooming target, and discovered an existing kernel sysctl interface usable for address disclosure; it was effective at repetitive offset/debugging work and porting findings across kernel versions. It could not produce a working exploit end-to-end without the staged framework, lost useful context across long sessions requiring resets, at one point attempted a workaround outside the intended exploitation path that required human correction, and needed human strategic direction throughout despite mechanical competency. No threat actor, campaign, or victim organization is identified; this is first-party vendor security research, not observed in-the-wild activity, and ships with no IOCs of adversary infrastructure.

MITRE ATT&CK techniques by tactic:

Discovery

T1082 System Information Discovery

Impact

T1499.004 Endpoint Denial of Service: Application or System Exploitation

Resource Development

T1585 Establish Accounts; T1587 Develop Capabilities; T1587.004 Develop Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1591 Gather Victim Org Information

privilege-escalation

T1611 Escape to Host

defense-impairment

T1685 Disable or Modify Tools

Remediation for FreeBSD VNET jail escape

Patches

• FreeBSD-SA-26:05.route (commits df932377e7dd, 5de6a55c70ba, 1eb2beb3686c, 7465d0b094b7, d521badafdaa, 8b476ffc4ea3, c2e2bfbd9e09)

Immediate actions

• Apply FreeBSD-SA-26:05.route via freebsd-update, pkg, or source patch on all FreeBSD 13.5, 14.3, 14.4, and 15.0 hosts
• Upgrade to 15.0-RELEASE-p4, 14.4-STABLE/RC1, 14.3-RELEASE-p9, or 13.5-RELEASE-p10 or later
• Restrict local shell/unprivileged account access on multi-tenant FreeBSD jail hosts until patched

Workarounds

• None available per FreeBSD-SA-26:05.route

Longer-term hardening

• Treat VNET jails as a materially larger kernel attack surface than non-networked jails when assessing isolation guarantees
• Instrument production-adjacent kernels with KASAN/sanitizers during QA to catch stack/heap overflow classes before release
• Track FreeBSD security advisories for the remaining ~7 unpatched issues reported from this research as they are disclosed
• Adopt LLM-assisted static analysis (CodeQL/semgrep rule generation) as a complementary internal code-review practice for kernel and other memory-unsafe codebases

Affected and fixed versions

• FreeBSD Foundation — FreeBSD Kernel (RTSock / routing socket subsystem)
  Vulnerable versions: 13.5 (before 13.5-RELEASE-p10); 14.3 (before 14.3-RELEASE-p9); 14.4 (before 14.4-STABLE patch); 15.0 (before 15.0-RELEASE-p4)
  Fixed in: 13.5-RELEASE-p10; 13.5-STABLE (8b476ffc4ea3); 14.3-RELEASE-p9; 14.4-STABLE (1eb2beb3686c); 14.4-RC1 (7465d0b094b7); 15.0-RELEASE-p4; 15.0-STABLE (df932377e7dd)

Timeline of FreeBSD VNET jail escape

• 2026-02-23 locked-ioc-2 (locked-ioc-4 Labs) reports the RTSock stack overflow to the FreeBSD security team.
• 2026-02-24 FreeBSD ships FreeBSD-SA-26:05.route patching CVE-2026-3038 across all supported branches, less than 24 hours after the report.
• 2026-03-09 NVD publishes CVE-2026-3038 with CVSS 3.1 score of 7.5 (HIGH) and CWE-787 classification.
• 2026-06-17 locked-ioc-4 publishes Part 1 of the FreeBSoD series detailing LLM-assisted discovery of roughly eight FreeBSD kernel vulnerabilities using locked-ioc-6/locked-ioc-5 and a KASAN-instrumented oracle VM.
• 2026-07-06 locked-ioc-4 confirms roughly seven additional kernel vulnerabilities discovered during the research remain unpatched and withholds exploitation detail to avoid mass exploitation.
• 2026-07-06 locked-ioc-4 publishes Part 2 of the FreeBSoD series, detailing two LLM-assisted kernel exploit chains achieving FreeBSD VNET jail escape, one of which uses CVE-2026-3038 as its memory-corruption primitive.

Sources cited for FreeBSD VNET jail escape

• FreeBSD-SA-26:05.route Security Advisory freebsd.org · Advisory · 2026-02-24
• NVD - CVE-2026-3038 NVD (NIST) · Advisory · 2026-03-09
• FreeBSD VuXML entry for CVE-2026-3038 vuxml.freebsd.org · Advisory · 2026-02-24
• FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2) praetorian.com · Research · 2026-07-06
• FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2) praetorian.com · Research · 2026-06-17
• CVE-2026-3038 (GCVE-0-2026-3038) db.gcve.eu · Research · 2026-03-09
• Aviatrix Threat Research Center - FreeBSD CVE-2026-3038 rtsock_msg_buffer Stack Overflow aviatrix.ai · Research · 2026-03-10

More in vulnerability

• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)
• CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware
• NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit
• iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet Security
• Balancer V2 ComposableStablePool Rounding/Invariant Manipulation Exploit (Nov 2025)