CVEFinder.io

CVE-2026-49418

⚠️ high
🔍 Scan for this CVE
Summary

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice. An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limit

Description

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice.

An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.

CVSS Score
8.8
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-08-19
First Seen: 2026-08-20
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 360,673 vulnerabilities in our database.

#69,256
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 20, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
slidybat
SSVC data provided by CISA
Last Modified 2026-09-01
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)

📦 Affected Products 4

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-58095 ⚠️ high 8.8 0.6 mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a... 2026-08-26
CVE-2026-58096 ⚠️ high 8.8 0.6 LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by... 2026-08-26
CVE-2026-58097 ⚠️ high 7.8 0.2 mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ... 2026-08-26
CVE-2026-49415 ⚠️ high 8.8 0.2 During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated... 2026-08-19
CVE-2026-49419 ⚠️ high 8.8 0.3 When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's curr... 2026-08-19
CVE-2026-49420 ⚠️ high 8.8 0.3 The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewr... 2026-08-19
These CVEs affect the same products