CVE-2026-49415

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description A race condition exists in the execve() system call during the execution of a SUID binary. The kernel installs the new virtual address space before updating the process credentials. This creates a window where a process running under the same user can access the target process memory via procfs or linprocfs, as the kernel debugging permission check still utilizes the original credentials. An unprivileged local user can exploit this synchronization error to modify the address space of a SUID binary before its credentials are elevated, potentially gaining full control of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.