{"api_version":"1","generated_at":"2026-08-19T11:44:41+00:00","cve":"CVE-2026-49418","urls":{"html":"https://cve.report/CVE-2026-49418","api":"https://cve.report/api/cve/CVE-2026-49418.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-49418","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-49418"},"summary":{"title":"Use-after-free in device pager page list","description":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list.  A subsequent page fault will cause the fault handler to re-insert the page into the object's list.  This corrupts the list, and on object destruction the page is freed twice.\n\nAn unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects (\"fictitious pages\") that are never recycled for a different purpose.  It may be possible to exploit this to escalate privileges.","state":"PUBLISHED","assigner":"freebsd","published_at":"2026-08-19 05:17:03","updated_at":"2026-08-19 05:17:03"},"problem_types":["CWE-416","CWE-416 CWE-416: Use After Free"],"metrics":[],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:37.vm.asc","name":"https://security.freebsd.org/advisories/FreeBSD-SA-26:37.vm.asc","refsource":"secteam@freebsd.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49418","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49418","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.1-RELEASE p1 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 15.0-RELEASE p11 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 14.4-RELEASE p7 release","platforms":[]},{"source":"CNA","vendor":"FreeBSD","product":"FreeBSD","version":"affected 14.3-RELEASE p16 release","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"slidybat","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","modules":["vm"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p1","status":"affected","version":"15.1-RELEASE","versionType":"release"},{"lessThan":"p11","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p7","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p16","status":"affected","version":"14.3-RELEASE","versionType":"release"}]}],"credits":[{"lang":"en","type":"finder","value":"slidybat"}],"datePublic":"2026-06-30T20:00:00.000Z","descriptions":[{"lang":"en","value":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list.  A subsequent page fault will cause the fault handler to re-insert the page into the object's list.  This corrupts the list, and on object destruction the page is freed twice.\n\nAn unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects (\"fictitious pages\") that are never recycled for a different purpose.  It may be possible to exploit this to escalate privileges."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416: Use After Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T04:14:17.429Z","orgId":"63664ac6-956c-4cba-a5d0-f46076e16109","shortName":"freebsd"},"references":[{"tags":["vendor-advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:37.vm.asc"}],"title":"Use-after-free in device pager page list","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"63664ac6-956c-4cba-a5d0-f46076e16109","assignerShortName":"freebsd","cveId":"CVE-2026-49418","datePublished":"2026-08-19T04:14:17.429Z","dateReserved":"2026-05-29T20:24:28.615Z","dateUpdated":"2026-08-19T04:14:17.429Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 05:17:03","lastModifiedDate":"2026-08-19 05:17:03","problem_types":["CWE-416","CWE-416 CWE-416: Use After Free"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"49418","Ordinal":"1","Title":"Use-after-free in device pager page list","CVE":"CVE-2026-49418","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"49418","Ordinal":"1","NoteData":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list.  A subsequent page fault will cause the fault handler to re-insert the page into the object's list.  This corrupts the list, and on object destruction the page is freed twice.\n\nAn unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects (\"fictitious pages\") that are never recycled for a different purpose.  It may be possible to exploit this to escalate privileges.","Type":"Description","Title":"Use-after-free in device pager page list"}]}}}