Kernel Use-After-Free in FreeBSD via msync(MS_INVALIDATE)

Executive Summary

This is a use-after-free vulnerability in the FreeBSD kernel's device pager page list. When msync(MS_INVALIDATE) is called on an unmanaged device object's mapping, physical pages are marked invalid but remain in the pager's list. A page fault later reinserts the page, corrupting the list. During object destruction, the page gets freed twice, leading to potential kernel memory corruption.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability requires checking if your FreeBSD system is running a vulnerable version. Use the command 'freebsd-version' to check the installed version. If the version is before the patched release dated after June 30, 2026, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An unprivileged local user with access to a memory-mapped I/O device could exploit this to trigger a use-after-free in the kernel. This may allow privilege escalation, enabling the attacker to gain higher system privileges than intended.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a kernel-level use-after-free issue in FreeBSD that could allow privilege escalation by an unprivileged local user with access to memory-mapped I/O devices. It does not directly impact data confidentiality or integrity but could enable unauthorized system access, which may lead to violations of compliance requirements that mandate strict access controls and system integrity (e.g., HIPAA for protected health information or GDPR for personal data processing). Exploitation could result in unauthorized modifications to systems handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade your FreeBSD system to a patched version released after June 30, 2026. Reboot the system to apply the fix. No workaround is available, so upgrading is the only mitigation.

Useful 0 Not Useful 0