FreeBSD Kernel up to p0.x/p6/p10/p15 Pager msync MS_INVALIDATE use after free

Summaryinfo

A vulnerability described as very critical has been identified in FreeBSD Kernel up to p0.x/p6/p10/p15. This affects the function msync of the component Pager. Such manipulation of the argument MS_INVALIDATE leads to use after free. This vulnerability is listed as CVE-2026-49418. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in FreeBSD Kernel up to p0.x/p6/p10/p15. It has been rated as very critical. Affected by this issue is the function msync of the component Pager. The manipulation of the argument MS_INVALIDATE with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.

The advisory is shared for download at security.freebsd.org. This vulnerability is handled as CVE-2026-49418 since 05/29/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/19/2026).

Upgrading to version p1, p7, p11 or p16 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• FreeBSD

Name

• Kernel

Version

• p0.x
• p6
• p10
• p15

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion