# FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)

> Praetorian research (Part 2 of 2) documents two FreeBSD amd64 kernel exploit chains for VNET jail escape, developed with a Claude Opus 4.6 / Claude Code agent over a weekend. Chain 1 pairs an unpatched kernel stack info leak with the CVE-2026-3038 RTSock stack overflow; chain 2 pairs a stack info leak with an unpatched heap overflow and pipe/file structure type confusion. Only CVE-2026-3038 is patched (FreeBSD-SA-26:05.route); no in-the-wild exploitation is reported.

- **Published:** 2026-11-03T03:46:08Z
- **Last reviewed:** 2026-11-03T03:46:08Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5118
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5118.png
- **ID:** TL-2026-5118
- **Severity:** MEDIUM (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-3038

## Description

CVE-2026-3038 is a stack-based buffer overflow (CWE-787) in rtsock_msg_buffer() in the FreeBSD routing-socket subsystem (sys/net/rtsock.c). The function copies sockaddr data into a fixed-size sockaddr_storage buffer on the stack without validating the source length for one sockaddr slot, letting an unprivileged local user trigger an overflow of up to 127 bytes via a crafted RTM_GET routing-socket message. On its own this corrupts the adjacent stack canary and causes a kernel panic (local denial of service). Praetorian Labs researcher Adam Crosser reported the bug to the FreeBSD security team on 2026-02-23; FreeBSD shipped FreeBSD-SA-26:05.route the next day (2026-02-24) with patches for all supported branches (13.5, 14.3, 14.4, 15.0) and no interim workaround. NVD rates it CVSS 3.1 7.5 (HIGH), AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Praetorian's two-part FreeBSoD series describes using an LLM coding agent across the full vulnerability-research lifecycle on FreeBSD. Part 1 (published 2026-06-17) covered discovery: the agent researched known FreeBSD kernel bug classes, generated CodeQL/semgrep rules from those patterns, swept kernel subsystems (scoped to 30,000-40,000 lines of code to fit context windows, including jail and VNET-exposed networking code), and validated candidate bugs against a KASAN-instrumented FreeBSD test VM used as an automated oracle. Roughly eight distinct issues were reported to FreeBSD's volunteer security team from this work; only CVE-2026-3038 has been publicly disclosed and patched, with the remainder described as awaiting remediation.

Part 2 (published 2026-07-06) describes turning two of the discovered bug combinations into working, reliable kernel-to-root exploit chains that escape a FreeBSD VNET jail, using a staged L0-L4 development methodology (crash detection, instruction-pointer control, end-to-end exploitation, mitigation-bypass integration, full weaponization) that gave the agent isolated, single-variable debugging signals at each stage. Both chains combine an undisclosed kernel stack information-disclosure bug (used to defeat stack-canary and KASLR protections) with a memory-corruption primitive to gain kernel code execution, then disable the CPU's SMEP/SMAP protections and pivot control flow to attacker-supplied kernel-mode logic that escalates the calling process's credentials to root, detaches it from its jail, and restores host-level filesystem/network visibility, completing a jail escape. Chain 1 uses the patched CVE-2026-3038 RTSock overflow as its memory-corruption primitive; Chain 2 instead uses an unpatched heap overflow in a kernel message-parsing interface combined with heap-grooming techniques (driving a kernel allocation zone into an attacker-influenced layout via repeated resource-table growth) and a type-confusion bug between two unrelated kernel object types that lets the attacker control the dispatch table used by follow-on system calls. Praetorian withheld implementation-level detail on the still-unpatched info-leak and heap-overflow bugs specifically to avoid enabling mass exploitation while patches are pending.

The research frames the agent's contribution and limits: it independently reasoned about kernel internals well enough to identify a memory-allocator caching behavior and a kernel file-descriptor-table structure as a grooming target, and discovered an existing kernel sysctl interface usable for address disclosure; it was effective at repetitive offset/debugging work and porting findings across kernel versions. It could not produce a working exploit end-to-end without the staged framework, lost useful context across long sessions requiring resets, at one point attempted a workaround outside the intended exploitation path that required human correction, and needed human strategic direction throughout despite mechanical competency. No threat actor, campaign, or victim organization is identified; this is first-party vendor security research, not observed in-the-wild activity, and ships with no IOCs of adversary infrastructure.

## MITRE ATT&CK

- T1685 Disable or Modify Tools
- T1611 Escape to Host
- T1082 System Information Discovery
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1587.004 Develop Capabilities: Exploits
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1591 Gather Victim Org Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FreeBSD CVE-2026-3038 RTSock rtsock_msg_buffer Overflow Kernel Panic (FreeBSoD) — Exploitation** (`TL-2026-5118-SPL-001`)

Detects kernel panic / fatal trap messages whose backtrace contains rtsock_msg_buffer, or the stack-protector panic 'stack overflow detected; backtrace may be corrupted'. An unmitigated CVE-2026-3038 overflow triggered by a crafted RTM_GET routing-socket message (invalid RTAX_AUTHOR sockaddr length) corrupts the stack canary and panics the kernel; failed attempts of the FreeBSoD jail-escape chain 1 look the same on unpatched 13.5/14.3/14.4/15.0 hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1499.004, T1068
- **Data sources:** freebsd_syslog, index=os sourcetype=syslog, Syslog table
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=os sourcetype=syslog earliest=-24h ("rtsock_msg_buffer" OR "stack overflow detected; backtrace may be corrupted" OR ("Fatal trap" "rtsock"))
| rex field=_raw "(?<panic_msg>panic: [^\r\n]+)"
| eval cve="CVE-2026-3038", technique="T1499.004"
| stats count min(_time) as first_seen max(_time) as last_seen values(panic_msg) as panic_msg by host cve technique
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("rtsock_msg_buffer", "stack overflow detected; backtrace may be corrupted")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Sample = take_any(SyslogMessage) by Computer
| project Computer, Events, FirstSeen, LastSeen, Sample
```

### Sigma

```yaml
title: FreeBSD CVE-2026-3038 RTSock Overflow Kernel Panic
id: 5b1c7a52-3d4e-4f6a-9c18-7e2a40d15118
status: experimental
description: Detects kernel panic output referencing rtsock_msg_buffer or a stack-protector failure, consistent with a failed CVE-2026-3038 (RTM_GET routing-socket) exploitation attempt.
references:
    - https://www.freebsd.org/security/advisories/FreeBSD-SA-26:05.route.asc
    - https://www.praetorian.com/blog/llm-kernel-exploit-development/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.impact
    - attack.t1499.004
    - attack.privilege-escalation
    - attack.t1068
    - cve.2026.3038
logsource:
    product: freebsd
    service: syslog
detection:
    keywords:
        - 'rtsock_msg_buffer'
        - 'stack overflow detected; backtrace may be corrupted'
    condition: keywords
falsepositives:
    - Unrelated kernel stack-protector panics from faulty drivers or hardware
    - Kernel developers testing rtsock changes on non-production hosts
level: high
```

**Known false positives:**

- Unrelated kernel panics from faulty drivers, hardware faults or other stack-protector failures
- Developers reproducing the CVE on lab hosts

**Tuning notes:** Index/sourcetype are assumed (FreeBSD /var/log/messages forwarded to index=os); adjust to your environment. Panic backtraces are only logged if the host reboots and savecore/dumpon or a remote console/syslog captures them. Only unpatched hosts (before 13.5-RELEASE-p10, 14.3-RELEASE-p9, 14.4 patch, 15.0-RELEASE-p4) are expected to match; exclude patched lab hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- FreeBSD Kernel Exploit Development and Vulnerability Acquisition Activity (FreeBSoD, CVE-2026-3038) — Exploitation (locked: unlock with TL Creds)
- FreeBSD Unexplained Effective UID Transition to Root (Kernel LPE) — Post-Exploitation (locked: unlock with TL Creds)
- FreeBSD File-Descriptor Table Growth and Pipe Creation Burst (UMA Heap Grooming) — Exploitation (locked: unlock with TL Creds)
- FreeBSD Unprivileged AF_ROUTE Routing-Socket Burst (RTM_GET, CVE-2026-3038) — Exploitation (locked: unlock with TL Creds)
- FreeBSD Kernel Memory Device Access or Kernel Module Load After Privilege Gain — Post-Exploitation (locked: unlock with TL Creds)
- FreeBSD Audit Subsystem Tampering After Escape (auditd Stop / audit -t) — Defense Impairment (locked: unlock with TL Creds)
- FreeBSD VNET Jail Escape — Process Jail ID Transition to Host (FreeBSoD) — Post-Exploitation (locked: unlock with TL Creds)
- FreeBSD KERN_PROC_FILEDESC Sysctl Kernel Address Leak Probing (FreeBSoD) — Discovery/Leak (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)](https://www.praetorian.com/blog/llm-kernel-exploit-development/)
- [FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)](https://www.praetorian.com/blog/ai-vulnerability-research-freebsd-kernel/)
- [FreeBSD-SA-26:05.route Security Advisory](https://www.freebsd.org/security/advisories/FreeBSD-SA-26:05.route.asc)
- [NVD - CVE-2026-3038](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-3038)
- [CVE-2026-3038 (GCVE-0-2026-3038)](https://db.gcve.eu/vuln/CVE-2026-3038)
- [FreeBSD VuXML entry for CVE-2026-3038](https://vuxml.freebsd.org/freebsd/fbc47390-11e9-11f1-8148-bc241121aa0a.html)
- [Aviatrix Threat Research Center - FreeBSD CVE-2026-3038 rtsock_msg_buffer Stack Overflow](https://aviatrix.ai/threat-research-center/freebsd-cve-2026-3038-rtsock-msg-buffer-stack-overflow)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5118