CVE-2026-49427 — posixshm: largepage shared memory objects not explicitly wired

Description (CNA)

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p1; affected 15.0-RELEASE before p11; affected 14.4-RELEASE before p7; affected 14.3-RELEASE before p16

CWE

CWE-826

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:44.posixshm.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.