A use‑after‑free flaw exists in the kernel’s pager when msync(MS_INVALIDATE) is performed on a memory‑mapped device object. The operation marks pages as invalid while leaving them in the pager’s page list, causing a subsequent page fault to re‑insert the page. This corrupts the list and results in a double free when the object is destroyed. The bug is reachable by an unprivileged local user who can map a device that provides memory‑mapped I/O, potentially allowing privilege escalation. The vulnerable objects are a limited pool of unused "fictitious pages" that are never recycled for a different purpose, which confines the damage to the affected page list.

The flaw impacts FreeBSD operating systems that allow unprivileged users to memory‑map a device. No specific version numbers are mentioned, so any installation that supports msync on device memory mappings could be vulnerable.

Risk and exploitability: The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the severity score of 8.8 indicates a high‑risk flaw. An attacker with local access to a device that allows memory‑mapped I/O can trigger a kernel double‑free that may lead to privilege escalation. The attack remains limited to a local user who can map the device; however, the high CVSS score underscores the seriousness of the flaw. The patch or mitigation status is currently unknown, so the potential remains unless the flaw is addressed by the vendor.