CVE-2026-49428

HighCVSS 8.4/10Last modified Nov 9, 2026

Description

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this.

An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-915

Affected software

Vendor	Product	Versions
FreeBSD	FreeBSD	>= 15.1-RELEASE, < p1; >= 15.0-RELEASE, < p11; >= 14.4-RELEASE, < p7; >= 14.3-RELEASE, < p16

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:44.posixshm.ascVendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Nov 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-494297.8The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocat CVE-2026-494307.8The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then use CVE-2026-494313.3The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadat CVE-2026-494327.5Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that CVE-2026-494335.0The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection. If an attacker can trick a CVE-2026-494347.5Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to pub CVE-2026-494359.8Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a spe CVE-2026-494367.3LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) ac CVE-2026-494394.3OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with CVE-2026-49448.8vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementat CVE-2026-494407.4Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and cryp CVE-2026-494419.1Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the n