FreeBSD CVE-2026-49428

Exploitation requires a local, unprivileged shell account on a FreeBSD system running one of the affected release levels (14.3-RELEASE before p16, 14.4-RELEASE before p7, 15.0-RELEASE before p11, or 15.1-RELEASE before p1). The vulnerable code path is reached by invoking open(2) with O_TRUNC or fspacectl(2) on a POSIX shared memory object that is internally backed by largepages - this is a standard kernel feature requiring no special configuration to activate. No elevated privileges are required to trigger the bug; any user who can open a shell can invoke the relevant syscalls. Exploitation is strictly local: remote attackers must first obtain shell-level code execution through an independent vulnerability or credential compromise before this flaw can be leveraged. The primary limiting factor for defenders is local access control: systems where all shell users are trusted present negligible risk from this specific vulnerability.

The CVSS base score of 8.4 with a full C:H/I:H/A:H impact triad correctly characterises the severity of a successful exploit - kernel-level privilege escalation is catastrophic by definition. However, the local attack vector (AV:L) fundamentally bounds realistic risk: exploitation requires an existing shell session, meaning remote attackers must first achieve a foothold before leveraging this flaw. The vendor's PR:N rating is debatable; in CVSS 3.1 practice, any local-account prerequisite is typically PR:L, so defenders should interpret the effective CVSS score as approximately 7.8 rather than 8.4. The EPSS score of 0.34% (27th percentile) reflects low near-term automated exploitation probability, consistent with a local-only vulnerability that requires manual targeting. The vulnerability is not in CISA's KEV catalog, and no public exploit code was identified in the provided intelligence. Despite the constrained vector, even a mid-sized municipal IT team in boleslawiec running multi-user FreeBSD servers should treat this as urgent, since a single malicious or compromised local account is sufficient to own the entire host. The attack surface is highest on shared hosting environments, research computing clusters, academic Unix servers, and any FreeBSD deployment where untrusted users hold shell access.

An attacker with an unprivileged local shell account on a vulnerable FreeBSD server opens a POSIX shared memory object backed by largepages using open(2) with the O_TRUNC flag, triggering the kernel's memory-free path on memory that remains referenced by active kernel structures. Before the allocator reclaims the freed region, the attacker's process issues further syscalls to read or write the now-free kernel memory, overwriting a function pointer or privilege field in a kernel object to escalate to root. No public exploit code has been identified, but the attack requires only standard syscall interfaces available to any unprivileged user, and largepage shared memory is enabled by default in FreeBSD.