Slidybat

**Name of the Vulnerable Software and Affected Versions** FreeBSD (affected versions not specified) **Description** Calling the `msync(MS INVALIDATE)` function on a mapping of an unmanaged device object causes physical pages in the mapping range to be marked invalid while remaining in the pager's page list. A subsequent page fault triggers the fault handler to re-insert the page into the object's list, which corrupts the list and leads to a double-free of the page during object destruction. An unprivileged local user with access to a device providing memory-mapped I/O can trigger this use-after-free condition in the kernel, potentially leading to privilege escalation. This issue is limited to a pool of fictitious pages that are not recycled for other purposes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.