EIP-2026-100957

This exploit leverages a race condition in FreeBSD's kevent() syscall on SMP systems, leading to a kernel NULL pointer dereference. It spawns two threads to trigger the vulnerability, ultimately executing arbitrary kernel code to escalate privileges to root.