FreeBSD CVE-2026-49418

The attack requires a local, authenticated user account on an affected FreeBSD system (14.3-RELEASE < p16, 14.4-RELEASE < p7, 15.0-RELEASE < p11, or 15.1-RELEASE < p1) and unprivileged read/write access to a device file that provides memory-mapped I/O via an unmanaged device object in the FreeBSD VM subsystem. The trigger mechanism - calling msync(MS_INVALIDATE) on such a mapping followed by a page fault - is straightforward to invoke, but converting the resulting double-free into a privilege escalation requires exploiting a pool of 'fictitious pages' that are never recycled for other kernel uses, which complicates the exploitation path. No network access is required; no user interaction beyond a local shell session is needed. The CVSS-supplied AV:N metric conflicts with these local access requirements and should not be used as the basis for network-exposure risk assessments without vendor clarification.

The provided CVSS vector (AV:N/AC:L/PR:L) conflicts directly with the CVE description, which states the attack requires local access to a device providing memory-mapped I/O - this is a local, not network-reachable, attack vector. Security teams should treat the AV:N metric with skepticism and verify against FreeBSD SA-26:37 before using the 8.8 score in prioritization decisions. EPSS at 0.14% (4th percentile) reflects very low observed exploitation probability, and there is no CISA KEV listing or identified public exploit code. The 'fictitious pages' pool constraint is a meaningful limiting factor: the double-free does not drop the attacker directly into a general-purpose kernel heap primitive, requiring additional exploitation sophistication to achieve privilege escalation. Real-world exploitation exposure is low for most organizations, since it demands local shell access plus unprivileged access to a character device exposing MMIO; cloud VMs and containerized workloads without raw device passthrough are largely unaffected. Systems with local untrusted users and MMIO-capable hardware (e.g., GPU-equipped workstations or FreeBSD-based storage appliances with custom device drivers) represent the realistic risk surface.

A local user on a FreeBSD workstation or server with read/write access to an MMIO-capable device file (such as a GPU device node or a custom peripheral) creates a memory mapping of that device, calls msync(MS_INVALIDATE) on a subrange to mark pages invalid, then accesses that memory range to trigger a page fault. The fault handler re-inserts the already-listed fictitious page, corrupting the pager's page list; when the mapping is subsequently destroyed, the kernel double-frees the page object. An attacker with sufficient kernel exploitation skill could leverage this corruption to escalate from an unprivileged user to root, though the constrained fictitious-page pool adds non-trivial exploitation complexity.