CVE-2026-49417
Last modified
CVE-2026-49417 is a high-severity vulnerability rated 7/10 on the CVSS scale. Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freebsd | Freebsd | 14.3 |
| Freebsd | Freebsd | 14.4 |
| Freebsd | Freebsd | 15.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-49417?
How severe is CVE-2026-49417?
How do I fix CVE-2026-49417?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49411Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…6.5
- CVE-2026-49412The kernel handler for IPV6_MSFILTER dropped a serializing l…7.8
- CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
- CVE-2026-49414The ELF image activator cleared per-process ASLR preference …7.8
- CVE-2026-49415During execve(2) of a SUID binary, the new virtual address s…8.8
- CVE-2026-49416The CONS_HISTORY ioctl handler did not adequately validate t…7.8
- CVE-2026-49418When msync(MS_INVALIDATE) is called on a mapping of an unman…8.8
- CVE-2026-49419When the JAIL_AT_DESC flag is specified, kern_jail_set() and…8.8
- CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…7.5
- CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
- CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
- CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
Are you affected by CVE-2026-49417?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST