CVE-2026-49415— Local privilege escalation via execve(2) TOCTOU race
Quick assessment
Affected
FreeBSD FreeBSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在执行 SUID 二进制文件时， 系统调用会先安装新的虚拟地址空间，然后才更新进程凭据。在此时间窗口内，由于内核的调试权限检查仍使用原始凭据，因此同一用户的其他进程可以通过 procfs 或 linprocfs 访问该目标进程的内存。 未经特权的本地用户可利用此竞态条件，在 SUID 二进制文件的权限提升之前修改其地址空间，从而可能完全控制受影响的系统。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49415
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local privilege escalation via execve(2) TOCTOU race
Source: CVE Program / CVE List V5
Vulnerability Description
During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw the original credentials.
An unprivileged local user can exploit this race to modify the address space of a SUID binary before its credentials are elevated, potentially gaining full control of the affected system.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49415
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49415
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49415 (1)
Same Patch Batch · FreeBSD · 2026-08-19 · 23 CVEs total
| CVE-2026-49423 | Remote DOS via uninitialized memory access in KTLS receive | |
| CVE-2026-58087 | Heap out-of-bounds access in semctl(2) | |
| CVE-2026-58088 | Race condition in ELF core dump segment counting | |
| CVE-2026-58083 | Use-after-free in kqueue copy-on-fork | |
| CVE-2026-58084 | Kernel stack disclosure via timer_settime(2) | |
| CVE-2026-58085 | Missing MAC validation in wg(4) packet decryption | |
| CVE-2026-58086 | ktrace(2) privilege incorrectly validated in jails | |
| CVE-2026-49425 | Kernel stack disclosure in 32-bit compatibility support | |
| CVE-2026-49424 | Kernel stack disclosure in Linux compatibility layer | |
| CVE-2026-58081 | Heap based buffer overflow in iconv(3) | |
| CVE-2026-58082 | Stack based buffer overflow in iconv(3) | |
| CVE-2026-49418 | Use-after-free in device pager page list | |
| CVE-2026-49426 | Incorrect audit records for ptrace(2) syscall requests | |
| CVE-2026-49427 | posixshm: largepage shared memory objects not explicitly wired | |
| CVE-2026-49428 | posixshm: system calls can incorrectly free memory of largepage objects | |
| CVE-2026-49420 | Buffer overflow in libalias RTSP handler | |
| CVE-2026-49422 | Use-after-free in TCP RACK stack option handler | |
| CVE-2026-49421 | unlinkat(2) ignores AT_RESOLVE_BENEATH flag | |
| CVE-2026-49430 | Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl | |
| CVE-2026-49429 | Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: FreeBSD
-
CVE-2026-58088
Race condition in ELF core dump segment counting -
CVE-2026-58087
Heap out-of-bounds access in semctl(2) -
CVE-2026-58086
ktrace(2) privilege incorrectly validated in jails -
CVE-2026-58085
Missing MAC validation in wg(4) packet decryption -
CVE-2026-58084
Kernel stack disclosure via timer_settime(2)
Same vendor: FreeBSD
-
CVE-2026-58088
Race condition in ELF core dump segment counting -
CVE-2026-58087
Heap out-of-bounds access in semctl(2) -
CVE-2026-58086
ktrace(2) privilege incorrectly validated in jails -
CVE-2026-58085
Missing MAC validation in wg(4) packet decryption -
CVE-2026-58084
Kernel stack disclosure via timer_settime(2)
Same weakness: CWE-367
V. Comments for CVE-2026-49415
No comments yet