FreeBSD sendfile SF_NOCACHE bug frees largepage pages, local privilege escalation
CVE-2026-49427 Published on August 19, 2026

posixshm: largepage shared memory objects not explicitly wired
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-49427 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Premature Release of Resource During Expected Lifetime

The program releases a resource that is still intended to be used by the program itself or another actor.


Products Associated with CVE-2026-49427

Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.

FreeBSD
 

Affected Versions

FreeBSD: