FreeBSD 14.4 and earlier versions contain a critical Remote Kernel RCE vulnerability (CVE-2026-4747) in the NFS server's RPCSEC_GSS module. Attackers can exploit this flaw to gain root access over the network by sending specially crafted Kerberos authentication packets. The vulnerability resides in the `svc_rpc_gss_validate()` function, where a stack buffer overflow occurs during RPC header reconstruction.

A malicious Kerberos ticket allows an attacker to trigger the overflow, leading to arbitrary code execution in kernel context. CVE-2026-4747 affects systems using the vulnerable kgssapi.ko module, primarily impacting NFS services on ports 2049/TCP. The flaw is particularly dangerous as it requires only a valid Kerberos ticket, even from unprivileged users, making it accessible in enterprise environments using Active Directory or FreeIPA.