FreeBSD Kernel Largepage Memory Corruption via Open(2) and fspacectl(2) Escalation
CVE-2026-49428 Published on August 19, 2026
posixshm: system calls can incorrectly free memory of largepage objects
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this.
An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Vulnerability Analysis
CVE-2026-49428 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Mass Assignment Vulnerability?
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CVE-2026-49428 has been classified to as a Mass Assignment vulnerability or weakness.
Products Associated with CVE-2026-49428
Want to know whenever a new CVE is published for FreeBSD? stack.watch will email you.
Affected Versions
FreeBSD:- Version 15.1-RELEASE and below p1 is affected.
- Version 15.0-RELEASE and below p11 is affected.
- Version 14.4-RELEASE and below p7 is affected.
- Version 14.3-RELEASE and below p16 is affected.