Privilege escalation via LD_PRELOAD injection in FreeBSD Linuxulator (CVE-2026-49413)

The FreeBSD Linuxulator incorrectly set AT_SECURE to zero in the ELF auxiliary vector for set-user-ID and set-group-ID Linux binaries because it checked the P_SUGID process flag before that flag is set during execve(2). As a result, glibc's runtime linker does not restrict dangerous features such as LD_PRELOAD. An unprivileged local user can exploit this to inject a shared library into a setuid/setgid Linux binary and gain that binary's elevated privileges. Affected versions: - All supported versions of FreeBSD We recommend updating to: 15.1-RC3-p1, 15.0-RELEASE-p10, 14.4-RELEASE-p6, 14.3-RELEASE-p15. CVSS 7.1 · our assessment: this_week Reference: https://security.freebsd.org/advisories/FreeBSD-SA-26:30.linux.asc Details: https://vuln.today/cve/CVE-2026-49413