What is the CVSS score of CVE-2026-6386?

CVE-2026-6386 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

FreeBSD Kernel CVE-2026-6386

EUVD-2026-24592 MEDIUM

Improper Privilege Management (CWE-269)

2026-04-22 freebsd

GHSA-99g5-mwj2-6xjq

Privilege Escalation Freebsd

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 15:22 vuln.today

CVSS changed

Apr 22, 2026 - 15:22 NVD

6.2 (MEDIUM)

EUVD ID Assigned

Apr 22, 2026 - 03:00 euvd

EUVD-2026-24592

Analysis Generated

Apr 22, 2026 - 03:00 vuln.today

CVE Published

Apr 22, 2026 - 02:33 nvd

MEDIUM 6.2

DescriptionCVE.org

In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled this failed to take into account the presence of 1GB largepage mappings created using the shm_create_largepage(3) interface. In particular, it would always treat a page directory page entry as pointing to another page table page.

The bug can be abused by an unprivileged user to cause pmap_pkru_update_range() to treat userspace memory as a page table page, and thus overwrite memory to which the application would otherwise not have access.

AnalysisAI

Unprivileged local users on FreeBSD can read sensitive kernel memory via a page table manipulation bug in pmap_pkru_update_range(). When applying protection keys to 1GB largepage mappings created through shm_create_largepage(3), the kernel incorrectly treats userspace memory as page table entries, enabling unauthorized information disclosure. This affects FreeBSD 13.5, 14.3, 14.4, and 15.0 releases and has been confirmed fixed by vendor patches.

Technical ContextAI

The vulnerability exists in the FreeBSD kernel's memory protection key (PKU/PKRU) management subsystem. When updating protection keys across an address range, the pmap_pkru_update_range() function must navigate page table hierarchies to identify which entries require updates. The bug occurs because the function fails to recognize 1GB largepage mappings, which are created via the shm_create_largepage(3) interface and represent a non-standard page directory entry structure. Instead of detecting these largepage entries, the code incorrectly interprets them as pointing to conventional page table pages, leading to out-of-bounds memory access. The underlying issue is improper privilege boundary checking (CWE-269) when manipulating page table structures without validating entry types. The vulnerability is architecture-specific to amd64 (x86-64) systems where largepage mappings and PKRU support are implemented.

RemediationAI

Apply the vendor-released patches immediately: FreeBSD 13.5-RELEASE-p12 or later, 14.3-RELEASE-p11 or later, 14.4-RELEASE-p2 or later, or 15.0-RELEASE-p6 or later. Administrators using 'freebsd-update' should run 'freebsd-update fetch install' followed by a system reboot. No workarounds are available; patching is mandatory for affected systems. Interim mitigation is to disable shm_create_largepage(3) functionality if workload-dependent, but this does not eliminate the underlying kernel vulnerability and is not recommended as a permanent solution. See https://security.freebsd.org/advisories/FreeBSD-SA-26:11.amd64.asc for detailed patch instructions and verification procedures.