FreeBSD Kernel EUVD-2026-62254

Exploitation requires a local, authenticated (low-privilege) session on a vulnerable FreeBSD system - the attacker must be able to execute arbitrary code as an unprivileged user. The attack specifically requires the ability to create a largepage-backed POSIX shared memory object (via shm_open and mmap with large page flags) and to invoke sendfile(2) with the SF_NOCACHE flag on that object. Largepage shared memory support must be available and usable by unprivileged users in the kernel configuration, which is the default on affected FreeBSD releases. No network access, no prior authentication bypass, and no specific application target are required - the attack is conducted entirely through standard unprivileged syscalls. Exploitation is limited to: local access only (not remotely triggerable), FreeBSD only (not Linux or other BSDs), and the specific unpatched patchlevel releases listed above.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) scores 8.8 (High), but the attack vector AV:N is inconsistent with the description's explicit statement that exploitation requires an unprivileged local user - a discrepancy that inflates the apparent network-reachability of the flaw. The realistic attack vector is local (AV:L), which materially reduces exploitability compared to the NVD score. EPSS reinforces this: at 0.34% (27th percentile), automated or widespread exploitation is unlikely. SSVC assesses exploitation status as 'none' and automatable as 'no', though technical impact is rated 'total' - consistent with a kernel use-after-free leading to privilege escalation. No KEV listing and no public POC have been identified. Overall, this is a genuine high-severity privilege escalation for multi-tenant or shared FreeBSD systems (hosting providers, jails with untrusted users), but substantially lower priority for single-user or tightly access-controlled deployments. The NVD CVSS AV:N metric should be treated with skepticism - verify with the FreeBSD Security Team advisory before using the NVD score for SLA purposes.

A local unprivileged user on a shared FreeBSD host (e.g., a multi-tenant server or a system with untrusted shell users) creates a largepage-backed POSIX shared memory object and maps it into their address space. They then invoke sendfile(2) with the SF_NOCACHE flag targeting this object, causing the kernel to free the backing pages. By reading through their still-valid mapping, the attacker can access the now-freed kernel memory, potentially reading sensitive kernel data or corrupting allocator state to escalate to root. No public proof-of-concept exists at time of analysis, but the primitives involved (POSIX shm, sendfile) are standard and well-understood kernel interfaces.