CVE-2026-49418

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.

• CWE-416

• https://security.freebsd.org/advisories/FreeBSD-SA-26:37.vm.ascVendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49412The kernel handler for IPV6_MSFILTER dropped a serializing l…7.8
• CVE-2026-49413The Linuxulator determined whether a binary was set-user-ID …7.1
• CVE-2026-49414The ELF image activator cleared per-process ASLR preference …7.8
• CVE-2026-49415During execve(2) of a SUID binary, the new virtual address s…8.8
• CVE-2026-49416The CONS_HISTORY ioctl handler did not adequately validate t…7.8
• CVE-2026-49417Second, the audio buffer backing a mapping could be freed wh…7
• CVE-2026-49419When the JAIL_AT_DESC flag is specified, kern_jail_set() and…8.8
• CVE-2026-4942IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker t…7.5
• CVE-2026-49420The RTSP handler in libalias rewrote outgoing packets into a…8.8
• CVE-2026-49421The kernel function that implements unlinkat(2) and funlinka…7.1
• CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
• CVE-2026-49423When building the iovec array for a received TLS 1.2 CBC rec…3.3