CVE-2026-49419— Jail reference count underflow
Quick assessment
Affected
FreeBSD FreeBSD
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当指定 JAIL_AT_DESC 标志时，kern_jail_set() 和 kern_jail_get() 在查找 jail 描述符之前，会释放调用者当前 prison 的引用。如果描述符查找失败，错误处理路径会再次释放同一个引用，导致引用计数被重复递减。 未提权的本地用户可以触发 prison 引用计数下溢（underflow），这可能导致 prison 结构体在仍被使用时被释放。如果在 jail 主机上触发此漏洞，通常会导致立即出现内核恐慌（panic）。然而，如果攻击者运行在 jail 环境中，则有可能利用
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49419
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Jail reference count underflow
Source: CVE Program / CVE List V5
Vulnerability Description
When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time.
An unprivileged local user can trigger a prison reference count underflow, which may cause the prison structure to be freed while still in use. When this is done on the jail host, the bug will generally result in an immediate panic. However, if the user is running in a jail, then it may be possible to exploit the bug to elevate privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
引用计数的更新不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49419
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49419
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49419 (1)
Same Patch Batch · FreeBSD · 2026-08-19 · 23 CVEs total
| CVE-2026-49423 | Remote DOS via uninitialized memory access in KTLS receive | |
| CVE-2026-58087 | Heap out-of-bounds access in semctl(2) | |
| CVE-2026-58088 | Race condition in ELF core dump segment counting | |
| CVE-2026-58083 | Use-after-free in kqueue copy-on-fork | |
| CVE-2026-58084 | Kernel stack disclosure via timer_settime(2) | |
| CVE-2026-58085 | Missing MAC validation in wg(4) packet decryption | |
| CVE-2026-58086 | ktrace(2) privilege incorrectly validated in jails | |
| CVE-2026-49425 | Kernel stack disclosure in 32-bit compatibility support | |
| CVE-2026-49424 | Kernel stack disclosure in Linux compatibility layer | |
| CVE-2026-58081 | Heap based buffer overflow in iconv(3) | |
| CVE-2026-58082 | Stack based buffer overflow in iconv(3) | |
| CVE-2026-49418 | Use-after-free in device pager page list | |
| CVE-2026-49426 | Incorrect audit records for ptrace(2) syscall requests | |
| CVE-2026-49427 | posixshm: largepage shared memory objects not explicitly wired | |
| CVE-2026-49428 | posixshm: system calls can incorrectly free memory of largepage objects | |
| CVE-2026-49420 | Buffer overflow in libalias RTSP handler | |
| CVE-2026-49422 | Use-after-free in TCP RACK stack option handler | |
| CVE-2026-49421 | unlinkat(2) ignores AT_RESOLVE_BENEATH flag | |
| CVE-2026-49430 | Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl | |
| CVE-2026-49429 | Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: FreeBSD
-
CVE-2026-58094
TOCTOU race in POSIX shared memory large page configuration -
CVE-2026-58093
Kernel use-after-free via tty ioctls -
CVE-2026-58097
ppp(8): missing length validation in mp_SetEnddisc() -
CVE-2026-58096
ppp(8): missing length validation in LcpDecodeConfig() -
CVE-2026-58095
ppp(8): incorrect length calculation in mp_Enddisc()
Same vendor: FreeBSD
-
CVE-2026-58094
TOCTOU race in POSIX shared memory large page configuration -
CVE-2026-58093
Kernel use-after-free via tty ioctls -
CVE-2026-58097
ppp(8): missing length validation in mp_SetEnddisc() -
CVE-2026-58096
ppp(8): missing length validation in LcpDecodeConfig() -
CVE-2026-58095
ppp(8): incorrect length calculation in mp_Enddisc()
Same weakness: CWE-911
-
CVE-2026-77587
Tor 0.4.9.11前存在释放后使用漏洞 -
CVE-2026-19380
Mullvad wireguard.sys IOCTL AdapterState reference count -
CVE-2024-45783
Grub2: fs/hfs+: refcount can be decremented twice -
CVE-2024-46972
GPU DDK - Security: Reference count overflow in pvr_sync_rol -
CVE-2023-5633
Kernel: vmwgfx: reference count issue leads to use-after-fre
V. Comments for CVE-2026-49419
No comments yet