A kernel stack buffer overflow in the setcred(2) system call on FreeBSD 14.x allows any unprivileged local user to escalate privileges to root. The root cause is a sizeof type error in kern_setcred_copyin_supp_groups() where sizeof(gid_t *) == 8 is used instead of sizeof(gid_t) == 4, causing a 60-byte overflow of attacker-controlled data before any privilege check. Working LPE exploits are described for amd64 GENERIC kernels both with and without SMAP/SMEP. The SMAP/SMEP-safe variant uses a gadget in zfs.ko (ZSTD_initCStream_advanced) to overwrite td_ucred with a fake credential structure planted via setproctitle(). The bug is tracked as CVE-2026-45250 and patched in FreeBSD 14.3-RELEASE-p14, 14.4-RELEASE-p5, and 15.0-RELEASE-p9. Users should apply patches via freebsd-update immediately; no userland mitigation exists for unpatched systems.
