CVE-2026-49418 FreeBSD CVE debrief

Who should care

System administrators, kernel developers, and security teams responsible for managing systems with FreeBSD or similar operating systems should be aware of this vulnerability. They should review kernel code handling msync(MS_INVALIDATE) on unmanaged device objects, verify and apply vendor patches or updates, and monitor system for suspicious activity related to device object mappings. Additionally, they should implement compensating controls to limit access to device objects and perform regular inventory checks for affected systems to ensure timely mitigation of potential risks.

Technical summary

The vulnerability occurs when msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object. The physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault causes the fault handler to re-insert the page into the object's list, corrupting it. On object destruction, the page is freed twice, leading to a use-after-free condition. This issue has significant implications for system stability and security, particularly in environments where unprivileged local users have access to devices providing memory-mapped I/O.

Defensive priority

High priority due to potential for privilege escalation

Recommended defensive actions

• Review kernel code handling msync(MS_INVALIDATE) on unmanaged device objects
• Verify and apply vendor patches or updates
• Monitor system for suspicious activity related to device object mappings
• Implement compensating controls to limit access to device objects
• Perform regular inventory checks for affected systems

Evidence notes

The vulnerability is related to the handling of msync(MS_INVALIDATE) on unmanaged device objects in the kernel. Physical pages in the mapping range are marked invalid but remain in the pager's page list, leading to a use-after-free condition on object destruction. This issue is exacerbated by the fact that fictitious pages are never recycled for a different purpose, potentially limiting the exploitability but also making it harder to definitively rule out exploitation vectors. Defenders should verify system configurations, review kernel code handling msync(MS_INVALIDATE), and monitor for suspicious activity related to device object mappings.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.