FreeBSD Linuxulator CVE-2026-49413

Requires the FreeBSD Linux compatibility layer (Linuxulator) to be enabled and at least one set-user-ID or set-group-ID Linux (not native FreeBSD) binary present and executable by the attacker; the actor must already have unprivileged local access to run commands and set environment variables. Exploitation is limited by these factors: it is local-only (AV:L, no remote/network path), it does not work against native FreeBSD setuid binaries, and hosts that do not enable the Linuxulator or expose no privileged Linux binaries are not exploitable. No user interaction from a victim and no non-default configuration beyond enabling Linux binary support is needed (PR:L reflects the required prior unprivileged foothold).

Signals are internally consistent and point to a real but locally-scoped privilege escalation rather than a mass-exploitation event. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms local access with low complexity and low existing privileges, and SSVC rates Technical Impact as 'total' - consistent with obtaining the full privileges of a setuid-root binary. However, SSVC Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no' (this is not a remotely wormable network flaw), which aligns with the very low EPSS score (0.14%, 4th percentile) and the absence of any KEV listing. One discrepancy worth flagging: the reported vector uses C:N despite SSVC 'total' technical impact and the fact that inheriting a setuid-root binary's privileges typically grants full confidentiality access - this analyst assesses C:H is more defensible (see assessed vector). Net: patch on a normal, prioritized cadence, especially on multi-user hosts running Linux binaries; this is not an emergency internet-facing exposure.

An unprivileged local user on a FreeBSD host that runs Linux binaries writes a small malicious shared library, sets LD_PRELOAD to point at it, and executes a setuid-root Linux binary. Because AT_SECURE is incorrectly zero, the Linux loader honors LD_PRELOAD and loads the attacker's library into the privileged process, running attacker code with the binary's elevated user/group ID. No public exploit code has been identified, but the technique is straightforward for anyone with local shell access.