Pages belonging to largepage shared memory objects were not explicitly wired. When a sendfile(2) call with the SF_NOCACHE flag transmitted such an object, the kernel freed the underlying pages even though mappings still existed. This flaw allows an unprivileged local user to read freed kernel memory, which can be leveraged to gain elevated privileges. The vulnerability is a classic example of CWE‑826, Improper Release of Lock or Resource before time.

FreeBSD operating system is affected. No specific version was listed in the advisory, so all installations that compile the current posixshm implementation may be impacted.

The EPSS score is below 1 %, and the flaw is not currently listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nevertheless, the vulnerability enables local attackers to fully compromise the host, which constitutes a severe and complete privilege escalation. Attackers must run locally to abuse the bug; no network exposure is required. The CVSS score of 8.8 underscores the high severity of the vulnerability.