{"id":"CVE-2026-49418","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-49418","summary":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list.  A subsequent…","details":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list.  A subsequent page fault will cause the fault handler to re-insert the page into the object's list.  This corrupts the list, and on object destruction the page is freed twice.\n\nAn unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects (\"fictitious pages\") that are never recycled for a different purpose.  It may be possible to exploit this to escalate privileges.","published":"2026-08-19T05:17:03.943","modified":"2026-08-20T19:16:53.203","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:37.vm.asc"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-20T19:16:53.203"}}