Vulnerability in Linux Binaries Affects FreeBSD's Linuxulator

CVE-2026-49413

What is CVE-2026-49413?

The Linuxulator in FreeBSD contains a vulnerability that allows an unprivileged local user to exploit binaries marked as set-user-ID or set-group-ID. Due to a flaw in the handling of the P_SUGID process flag during the execve() call, the AT_SECURE variable can be mistakenly set to zero. This misconfiguration permits the injection of a shared library utilizing LD_PRELOAD, enabling the attacker to execute code with the elevated privileges of the compromised binary.

References