In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper main…

published 2018-09-28 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-18669

cvss: 5.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits: 0; none known

In FreeBSD before 11.2-STABLE(r338986), 11.2-RELEASE-p4, 11.1-RELEASE-p15, 10.4-STABLE(r338985), and 10.4-RELEASE-p13, due to improper maintenance of IPv6 protocol control block flags through various failure paths, an unprivileged authenticated local user may be able to cause a NULL pointer dereference causing the kernel to crash.

Patch / fix

fixed in 1 links 1

freebsd freebsd 11.2

security.freebsd.org/advisories/FreeBSD-EN-18:11.listen.asc advisory

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.9	AV:L/AC:L/Au:N/C:N/I:N/A:C

Affected products

FreeBSD FreeBSD

Classification

Weakness

CWE-476 NULL Pointer Dereference

References

security.freebsd.org /advisories/FreeBSD-EN-18:11.listen.asc
patch, vendor-advisory
flexera.com /company/secunia-research/advisories/SR-2018-21.html

Sources

CVE List CVE-2018-6925
NVD CVE-2018-6925

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary