CVE-2026-49428

Published: Aug 19, 2026Modified: Sep 1, 2026

8.4

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Affected (38)

Products: Freebsd: Freebsd

Freebsd

1 product

Freebsd

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 14.3
Freebsd Freebsd	Version 14.3 p10
Freebsd Freebsd	Version 14.3 p11
Freebsd Freebsd	Version 14.3 p12
Freebsd Freebsd	Version 14.3 p13
Freebsd Freebsd	Version 14.3 p14
Freebsd Freebsd	Version 14.3 p15
Freebsd Freebsd	Version 14.3 p1
Freebsd Freebsd	Version 14.3 p2
Freebsd Freebsd	Version 14.3 p3
Freebsd Freebsd	Version 14.3 p4
Freebsd Freebsd	Version 14.3 p5
Freebsd Freebsd	Version 14.3 p6
Freebsd Freebsd	Version 14.3 p7
Freebsd Freebsd	Version 14.3 p8
Freebsd Freebsd	Version 14.3 p9
Freebsd Freebsd	Version 14.4
Freebsd Freebsd	Version 14.4 p1
Freebsd Freebsd	Version 14.4 p2
Freebsd Freebsd	Version 14.4 p3
Freebsd Freebsd	Version 14.4 p4
Freebsd Freebsd	Version 14.4 p5
Freebsd Freebsd	Version 14.4 p6
Freebsd Freebsd	Version 14.4 rc1
Freebsd Freebsd	Version 15.0
Freebsd Freebsd	Version 15.0 p10
Freebsd Freebsd	Version 15.0 p1
Freebsd Freebsd	Version 15.0 p2
Freebsd Freebsd	Version 15.0 p3
Freebsd Freebsd	Version 15.0 p4
Freebsd Freebsd	Version 15.0 p5
Freebsd Freebsd	Version 15.0 p6
Freebsd Freebsd	Version 15.0 p7
Freebsd Freebsd	Version 15.0 p8
Freebsd Freebsd	Version 15.0 p9
Freebsd Freebsd	Version 15.1
Freebsd Freebsd	Version 15.1 rc2
Freebsd Freebsd	Version 15.1 rc3-p1

Related CWEs

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (1)

https://security.freebsd.org/advisories/FreeBSD-SA-26:44.posixshm.asc

Source: secteam@freebsd.org

Vendor Advisory

Timeline

No history available yet.