Description
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them.

An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Published: 2026-08-19
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Title posixshm: largepage shared memory objects not explicitly wired
Weaknesses CWE-826
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: freebsd

Published:

Updated: 2026-08-19T05:56:53.494Z

Reserved: 2026-05-29T20:24:28.616Z

Link: CVE-2026-49427

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T06:17:41.977

Modified: 2026-08-19T06:17:41.977

Link: CVE-2026-49427

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-826

    Premature Release of Resource During Expected Lifetime