CVE-2026-49418

Name of the Vulnerable Software and Affected Versions FreeBSD (affected versions not specified)

Description Calling the msync(MS INVALIDATE) function on a mapping of an unmanaged device object causes physical pages in the mapping range to be marked invalid while remaining in the pager's page list. A subsequent page fault triggers the fault handler to re-insert the page into the object's list, which corrupts the list and leads to a double-free of the page during object destruction. An unprivileged local user with access to a device providing memory-mapped I/O can trigger this use-after-free condition in the kernel, potentially leading to privilege escalation. This issue is limited to a pool of fictitious pages that are not recycled for other purposes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.