Multiple vulnerabilities in POSIX largepage objects
FreeBSD-SA-26:44.posixshm · CVE-2026-49427, CVE-2026-49428
Our decision for FreeSense
FreeBSD corrected this on 2026-06-30, before the FreeBSD source pin of every FreeSense version.
- Advisory: corrected 2026-06-30
- FreeSense 1.0 pin: e004ff15f87e (2026-08-03)
- FreeSense 1.1 pin: a52c50b4b7c2 (2026-10-04)
- FreeSense 1.2 pin: a52c50b4b7c2 (2026-10-04)
By FreeSense version
| Version | Status | FreeBSD pin |
|---|---|---|
| FreeSense 1.01.0.7 · frozen, no further fixes | FixedFreeBSD pin of 2026-08-03 | 2026-08-03e004ff15 |
| FreeSense 1.11.1.9 | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
| FreeSense 1.21.2.0-DEVELOPMENT | FixedFreeBSD pin of 2026-10-04 | 2026-10-04a52c50b4 |
Workaround
No workaround is available.
What FreeBSD says
Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. [CVE-2026-49427] Separately, certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. [CVE-2026-49428]
Impact
An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Excerpt from the FreeBSD advisory. Read the original for the full text and the fix.