{"apiVersion":"1.0","identifier":"CVE-2026-49418","description":"When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager-s page list. A subsequent page fault will cause the fault handler to re-insert the page into the object-s list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects (-fictitious pages-) that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.","publishedAt":"2026-08-19T05:17:03","lastModifiedAt":"2026-08-26T16:54:50","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49418","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.0028,"riskScore":0.9,"affectedProduct":"FreeBSD","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-49418","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-49418","en":"https://www.redsauce.net/en/cves/CVE-2026-49418","fr":"https://www.redsauce.net/fr/cves/CVE-2026-49418","pt":"https://www.redsauce.net/pt/cves/CVE-2026-49418","de":"https://www.redsauce.net/de/cves/CVE-2026-49418","sk":"https://www.redsauce.net/sk/cves/CVE-2026-49418","el":"https://www.redsauce.net/el/cves/CVE-2026-49418"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-49418"}}