CVE-2026-6386
Memory Corruption via PKRU Update Bug in FreeBSD Kernel
Publication date: 2026-04-22
Last updated on: 2026-05-01
Assigner: FreeBSD
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 14.4 |
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.4 |
| freebsd | freebsd | 15.0 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 13.5 |
| freebsd | freebsd | 14.3 |
| freebsd | freebsd | 14.4 |
| freebsd | freebsd | 15.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the FreeBSD amd64 kernel's handling of memory protection keys (pkru), specifically in the function pmap_pkru_update_range().
The function is supposed to update page table entries to apply protection keys to memory regions. However, it incorrectly assumes that a page directory entry always points to a page table page and does not properly handle 1GB large page mappings created via the shm_create_largepage(3) interface.
Because of this, an unprivileged user can exploit the bug to trick the function into treating user-space memory as a page table page, which can lead to overwriting memory areas that should be protected.
How can this vulnerability impact me? :
An unprivileged user can exploit this vulnerability to cause the kernel to overwrite memory regions that the application or user should not have access to.
This can lead to unauthorized memory modification, potentially allowing privilege escalation or other malicious actions that compromise system security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands or network indicators provided for this vulnerability. It is a kernel-level issue related to memory protection key handling in FreeBSD amd64 systems.
Detection would primarily involve verifying the FreeBSD system version and whether the system has been updated with the patches addressing CVE-2026-6386.
You can check your FreeBSD version with the command: `freebsd-version`.
To verify if the system is patched, you may compare installed patches or check the update history, but no direct commands to detect exploitation or presence of the vulnerability are provided.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade your FreeBSD system to a patched version released on or after April 21, 2026.
- If using pkg(8) for base system package installations, run: `pkg upgrade -r FreeBSD-base` and then reboot the system.
- If using freebsd-update(8) for binary distribution set installations, run: `freebsd-update fetch` and `freebsd-update install` followed by a reboot.
- Alternatively, apply the source code patches manually by downloading the appropriate patch for your FreeBSD version, verifying its PGP signature, applying it to the source tree, recompiling the kernel, and rebooting.
No workaround is available other than applying these updates or patches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unprivileged user to overwrite memory areas that should be protected, potentially leading to unauthorized access or modification of sensitive data.
Such unauthorized memory access and modification could compromise the confidentiality and integrity of data, which are critical requirements under common standards and regulations like GDPR and HIPAA.
Therefore, if exploited, this vulnerability could lead to non-compliance with these regulations due to potential data breaches or unauthorized data manipulation.