Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet

CVE-2026-4747 is a stack-based buffer overflow in FreeBSD's RPCSEC_GSS packet validation path, affecting both the kernel-side kgssapi.ko implementation used by NFS and the userland librpcsec_gss library. FreeBSD says all supported versions were affected at disclosure on 2026-03-26, with fixes released in 13.5-RELEASE-p11, 14.3-RELEASE-p10, 14.4-RELEASE-p1, and 15.0-RELEASE-p5. The vulnerable routine reconstructs part of an incoming RPCSEC_GSS packet into a fixed stack buffer without verifying the incoming length, so a malicious packet can overflow the stack.

The vendor's HIGH 8.8 baseline is technically understandable because the end state is remote code execution, including kernel-context execution when the NFS path is in play. But operationally this is not a generic internet-wide FreeBSD RCE: the target must be running a reachable RPC server, and for the base-system kernel path that means FreeBSD NFS with kgssapi.ko loaded. That narrower exposure keeps this out of CRITICAL, but the public exploit and kernel impact keep it firmly above MEDIUM.

Why this verdict

• Kernel RCE is still kernel RCE: if the NFS/kgssapi.ko path is reachable, compromise can land in kernel context. That alone prevents a MEDIUM rating.
• Exposure population is narrower than the CVSS implies: the attacker needs a reachable FreeBSD RPC service, and the base-system kernel path specifically needs NFS with kgssapi.ko loaded. That is a major downward adjustment from a generic network daemon bug.
• Public exploit lowers attacker cost: NVD links to a live GitHub PoC with exploit.py, so this is not a theory-only memory corruption issue. I add risk back for weaponization maturity.
• No exploitation evidence and low EPSS push downward: it is not KEV-listed and the supplied EPSS is very low. That matters when deciding whether this is a fleet-wide fire drill versus a targeted service hardening problem.

Why not higher?

It is not CRITICAL because the reachable population is gated by a specific service role and module state, not just 'host is FreeBSD.' Most enterprises do not expose Kerberos-enabled NFS broadly, and there is no authoritative evidence here of active exploitation or KEV inclusion.

Why not lower?

It is not MEDIUM because the technical outcome is severe and the exploit bar is no longer purely research-grade. A public PoC against a network-reachable kernel-facing parser means any environment that actually runs the vulnerable path has meaningful compromise risk.

1. Restrict NFS reachability — Lock down 2049/tcp to approved client networks only and remove any internet exposure. For a HIGH verdict, deploy this control within 30 days anywhere patching cannot happen immediately.
2. Disable unused NFS services — If the host is not intentionally serving NFS, turn off nfsd and related RPC exposure to remove the vulnerable entry point entirely. Do this within 30 days on all dormant or accidental NFS servers.
3. Unload or avoid kgssapi.ko where unnecessary — FreeBSD explicitly says kernels without kgssapi.ko loaded are not vulnerable on the kernel path. If Kerberos-backed NFS is not required, remove that module from the runtime and boot configuration within 30 days.
4. Monitor for malformed NFS/RPC activity — Add temporary detection around unusual traffic to 2049/tcp, repeated session failures, nfsd instability, and kernel panic indicators. This is not a patch substitute, but it improves time-to-detect while you work through remediation within 30 days.

Run this on the FreeBSD target host as root or with enough privilege to read kernel module state and service/process information. Save it as check-cve-2026-4747.sh, then run sudo sh check-cve-2026-4747.sh; it reports VULNERABLE, PATCHED, or UNKNOWN based on release level and whether the obvious kernel/NFS exposure path is present.

#!/bin/sh
# check-cve-2026-4747.sh
# FreeBSD target-side check for CVE-2026-4747
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

kv="$(freebsd-version -k 2>/dev/null || true)"
uv="$(freebsd-version -u 2>/dev/null || true)"
rv="${kv:-$uv}"

if [ -z "$rv" ]; then
  echo "UNKNOWN: unable to determine FreeBSD version"
  exit 2
fi

# Determine whether the obvious kernel attack path is exposed.
kgss_loaded="no"
if command -v kldstat >/dev/null 2>&1; then
  if kldstat -q -m kgssapi 2>/dev/null; then
    kgss_loaded="yes"
  fi
fi

nfs_running="no"
if pgrep -x nfsd >/dev/null 2>&1; then
  nfs_running="yes"
fi

nfs_listening="unknown"
if command -v sockstat >/dev/null 2>&1; then
  if sockstat -4 -6 -l 2>/dev/null | awk '$6 ~ /:2049$/ {found=1} END{exit(found?0:1)}'; then
    nfs_listening="yes"
  else
    nfs_listening="no"
  fi
fi

is_vuln_version="unknown"
reason=""

case "$rv" in
  13.5-RELEASE-p[0-9]|13.5-RELEASE-p10|13.5-RELEASE)
    is_vuln_version="yes"
    reason="13.5 before p11"
    ;;
  13.5-RELEASE-p1[1-9]*|13.5-RELEASE-p[2-9][0-9]*)
    is_vuln_version="no"
    reason="13.5 patched at p11+"
    ;;
  14.3-RELEASE-p[0-9]|14.3-RELEASE)
    is_vuln_version="yes"
    reason="14.3 before p10"
    ;;
  14.3-RELEASE-p1[0-9]*|14.3-RELEASE-p[2-9][0-9]*)
    is_vuln_version="no"
    reason="14.3 patched at p10+"
    ;;
  14.4-RELEASE|14.4-RELEASE-p0)
    is_vuln_version="yes"
    reason="14.4 before p1"
    ;;
  14.4-RELEASE-p[1-9]* )
    is_vuln_version="no"
    reason="14.4 patched at p1+"
    ;;
  15.0-RELEASE-p[0-4]|15.0-RELEASE)
    is_vuln_version="yes"
    reason="15.0 before p5"
    ;;
  15.0-RELEASE-p[5-9]* )
    is_vuln_version="no"
    reason="15.0 patched at p5+"
    ;;
  *)
    is_vuln_version="unknown"
    reason="unsupported, non-RELEASE, or unrecognized branch; compare against FreeBSD advisory commits"
    ;;
esac

if [ "$is_vuln_version" = "no" ]; then
  echo "PATCHED: $rv ($reason); kgssapi_loaded=$kgss_loaded nfsd_running=$nfs_running nfs_listening_2049=$nfs_listening"
  exit 0
fi

if [ "$is_vuln_version" = "yes" ]; then
  if [ "$kgss_loaded" = "yes" ] || [ "$nfs_running" = "yes" ] || [ "$nfs_listening" = "yes" ]; then
    echo "VULNERABLE: $rv ($reason); kernel/NFS exposure indicators present: kgssapi_loaded=$kgss_loaded nfsd_running=$nfs_running nfs_listening_2049=$nfs_listening"
    exit 1
  else
    echo "UNKNOWN: $rv ($reason); version is vulnerable but obvious kernel/NFS exposure indicators were not found. Advisory notes kernels without kgssapi.ko loaded are not vulnerable on the kernel path; third-party userland RPCSEC_GSS servers may still apply."
    exit 2
  fi
fi

echo "UNKNOWN: $rv ($reason); kgssapi_loaded=$kgss_loaded nfsd_running=$nfs_running nfs_listening_2049=$nfs_listening"
exit 2

Sources

1. NVD CVE record
2. FreeBSD advisory
3. FreeBSD fix review / commit summary
4. FreeBSD 14.4 errata and advisory index
5. GitHub PoC directory
6. GitHub PoC exploit.py
7. FreeBSD handbook: network servers / NFS
8. CISA Known Exploited Vulnerabilities Catalog