CVE-2026-49428 — posixshm: system calls can incorrectly free memory of largepage objects

CVE-2026-49428

posixshm: system calls can incorrectly free memory of largepage objects PUBLISHED

Description (CNA)

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Affected (CNA)

Vendor / product	Versions
FreeBSD / FreeBSD	affected 15.1-RELEASE before p1; affected 15.0-RELEASE before p11; affected 14.4-RELEASE before p7; affected 14.3-RELEASE before p16

CWE

CWE-915

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:44.posixshm.asc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.