CVE-2026-49427
Received Received - Intake

Pages Not Wired in FreeBSD Kernel Memory Access

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: FreeBSD

Description
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49427
EUVD
EUVD-2026-62254

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freebsd freebsd From 14 (inc) to 15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-826 The product releases a resource that is still intended to be used by itself or another actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of memory in POSIX largepage shared memory objects on FreeBSD. Pages in these objects were not properly wired, meaning they could be freed while still being accessible through existing mappings. When sendfile(2) with the SF_NOCACHE flag transmits such objects, the underlying pages are freed after transmission, but mappings still refer to them. This allows an unprivileged local user to access freed kernel memory.

Detection Guidance

This vulnerability is specific to FreeBSD systems using POSIX largepage shared memory objects. Detection requires checking if your system is running a vulnerable version of FreeBSD. Use 'uname -a' to check the FreeBSD version. If your system is running a version prior to the patched branches (stable/15, stable/14, or their release branches updated after June 30, 2026), it is likely vulnerable.

Impact Analysis

An unprivileged local attacker could exploit this flaw to access freed kernel memory, potentially leading to privilege escalation. This means an attacker could gain elevated access to the system, bypassing normal security restrictions.

Mitigation Strategies

Upgrade your FreeBSD system to a patched version (stable/15, stable/14, or their release branches updated after June 30, 2026) using pkg(8), freebsd-update(8), or source code. After updating, reboot the system to apply the changes. No workaround is available, so upgrading is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49427. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart