Use-After-Free Vulnerability in FreeBSD's Memory Mapped I/O Device Handling

CVE-2026-49418

What is CVE-2026-49418?

A vulnerability exists in FreeBSD's kernel memory management that can be exploited by an unprivileged local user. When msync(MS_INVALIDATE) is invoked on an unmanaged device's mapping, the affected physical pages are marked invalid but are erroneously retained in the pager's page list. This leads to a corruption of the list, causing double freeing upon the object's destruction. Although limited to a specific pool of fictitious pages, this flaw may allow exploitation to escalate privileges via targeted access to memory-mapped I/O devices.

References