CVE-2026-49418: Use-after-free in device pager page list
When msync(MSINVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice.
An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
An unprivileged local user is exposed if they have access to a device that provides memory-mapped I/O and can create a mapping of an unmanaged device object. The issue is in the kernel, so exploitation is local rather than described as network-reachable.
What actions are required to trigger the flaw?
The attacker needs to call msync with MS_INVALIDATE on the relevant mapping, then trigger a subsequent page fault. The resulting page-list corruption leads to a double free when the object is destroyed.
How severe is the potential impact?
The condition produces a kernel use-after-free and may allow privilege escalation. The affected pages are limited to fictitious pages, a pool that is not recycled for a different purpose, which constrains the described exploitation path.