CVE-2026-49428— posixshm: system calls can incorrectly free memory of largepage objects
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49428
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
posixshm: system calls can incorrectly free memory of largepage objects
Source: CVE Program / CVE List V5
Vulnerability Description
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-49428
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49428
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49428 (1)
Same Patch Batch · FreeBSD · 2026-08-19 · 23 CVEs total
| CVE-2026-49423 | Remote DOS via uninitialized memory access in KTLS receive | |
| CVE-2026-58087 | Heap out-of-bounds access in semctl(2) | |
| CVE-2026-58088 | Race condition in ELF core dump segment counting | |
| CVE-2026-58083 | Use-after-free in kqueue copy-on-fork | |
| CVE-2026-58084 | Kernel stack disclosure via timer_settime(2) | |
| CVE-2026-58085 | Missing MAC validation in wg(4) packet decryption | |
| CVE-2026-58086 | ktrace(2) privilege incorrectly validated in jails | |
| CVE-2026-49425 | Kernel stack disclosure in 32-bit compatibility support | |
| CVE-2026-49424 | Kernel stack disclosure in Linux compatibility layer | |
| CVE-2026-58081 | Heap based buffer overflow in iconv(3) | |
| CVE-2026-58082 | Stack based buffer overflow in iconv(3) | |
| CVE-2026-49418 | Use-after-free in device pager page list | |
| CVE-2026-49426 | Incorrect audit records for ptrace(2) syscall requests | |
| CVE-2026-49427 | posixshm: largepage shared memory objects not explicitly wired | |
| CVE-2026-49420 | Buffer overflow in libalias RTSP handler | |
| CVE-2026-49422 | Use-after-free in TCP RACK stack option handler | |
| CVE-2026-49421 | unlinkat(2) ignores AT_RESOLVE_BENEATH flag | |
| CVE-2026-49430 | Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl | |
| CVE-2026-49429 | Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl | |
| CVE-2026-49431 | Incorrect user validation in ZFS_IOC_SET_PROP ioctl |
Showing top 20 of 23 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: FreeBSD
Same vendor: FreeBSD
Same weakness: CWE-915
- CVE-2026-62315
Frappe: Mass assignment via set_value - CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined - CVE-2026-71473
Acm-search-v2-rhel9: search-v2-operator: addonfactory.getval - CVE-2026-17095
IBM i is Affected By Multiple Vulnerabilities in Navigator f - CVE-2026-72778
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via cond
V. Comments for CVE-2026-49428
No comments yet