Saint FatGid, of the Too Many Supplementary Groups

Patron of the setcred call, stack buffers measured wrong, and BSD kernels caught out.

Life

On 21 May 2026 the FreeBSD security team, on a report by Przemysław Frasunek, published FatGid (CVE-2026-45250). The setcred system call copied the user-supplied list of supplementary groups into a kernel stack buffer before validating its length, and before even checking the caller's privileges. An unprivileged user could thus overflow the stack: on versions 14.3 and 14.4 the author reached a root shell.

Prayer

O Saint FatGid, who copies the list before counting it, let our kernels always measure before they write. Amen.

How to celebrate

Celebrated by updating to 14.3-p14, 14.4-p5 or 15.0-p9 and rebooting, because half a patch is no patch.

Long list, short stack.

Technical record

Disclosed on: May 21 2026
CVE: CVE-2026-45250
CVSS: 7.8
Product: FreeBSD · FreeBSD

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validating its length. If the supplied list exceeds the capacity of that buffer, a stack buffer overflow occurs. Because the bounds check on the supplementary groups list occurs after the kernel stack buffer has already been written, an unprivileged local user may trigger the overflow without holding any special privilege. Successful exploitation may allow an attacker to execute arbitrary code in the context of the kernel, allowing an unprivileged local user to gain elevated privileges on the affected system.

Sources: fatgid.io

Canonized during the vacant see

Saint FatGid, of the Too Many Supplementary Groups

Life

Prayer

How to celebrate

Technical record

Related saints

Sharing the feast day

Same product: FreeBSD

Same year: 2026