FreeBSD Kernel CVE-2026-6386

Exploitation requires: (1) local user-level code execution on a vulnerable FreeBSD system, (2) the shm_create_largepage(3) interface to be available in the kernel (enabled by default in standard FreeBSD builds), and (3) use of memory protection key operations (pkey_mprotect or related syscalls) on the largepage-mapped memory region. The vulnerability is amd64-specific and does not affect other architectures. Non-amd64 systems (i386, ARM, etc.) are NOT vulnerable. The attack is NOT remote and does not require authentication, but it IS limited to users with local shell access or code execution. Default FreeBSD configurations are vulnerable if the affected kernel versions are running; no special tunables or hardening options prevent exploitation.

This vulnerability presents moderate real-world risk despite the low EPSS score of 0.02%. CVSS 6.2 (AV:L/AC:L/PR:N) correctly identifies a local, unprivileged attack vector with no attack complexity, confirming accessibility to any user on affected systems. The low EPSS percentile (4th) suggests limited exploit prevalence, likely because shm_create_largepage(3) usage is uncommon in production workloads and the vulnerability requires specific kernel version combinations. However, the confidentiality impact (C:H) is confirmed - attackers read unrestricted kernel memory, which may leak cryptographic keys, ASLR bypasses, or other sensitive data. The integrity and availability impacts are rated None, limiting scope; attackers cannot modify kernel state or cause denial of service through this path alone. No active CISA KEV listing or public POC has been identified, suggesting this is a researcher-discovered vulnerability with vendor-coordinated disclosure. For systems running vulnerable FreeBSD versions with largepage workloads (e.g., high-performance databases, caching systems), this warrants prioritized patching; for standard deployments without largepage usage, risk is lower but not eliminated since exploitation requires no special privileges or user interaction.

A local attacker without special privileges creates a shared memory largepage segment using shm_create_largepage(3), then manipulates protection keys via a PKRU-modifying syscall (such as pkey_mprotect). The kernel's flawed pmap_pkru_update_range() function misinterprets the largepage directory entry, treating userspace memory as a page table, allowing the attacker to read arbitrary kernel memory locations. This could be used to leak KASLR offsets or encryption keys.